Threats Tagged 'cwe-444'

### Impact h2 <=4.4.0 accepts request header blocks containing more than one Host header, and forwards every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, which is a request smuggling primitive (CWE-444). ### Patches Patched and fixed in v4.4.1 ### Workarounds Users of the h2 library are advised to check and follow HTTP semantics best practices in their application code. h2 provides best effort sanity checks, but ultimately the calling code is responsible to ensure proper and safe usage of HTTP/2 as provided by h2, hyperframe, and hpack. ### References Similar to the previously disclosed and fixed duplicate content-length issue.

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP request containing both Content-Length and Transfer-Encoding headers causes a reverse proxy and MarkLogic Server to interpret request boundaries differently.

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js can omit headers beyond `maxHeadersCount` / `maxHeaderPairs` from `req.headers`, `req.rawHeaders`, and `req.headersDistinct`, while still using those omitted headers internally for HTTP message framing. In particular, `Content-Length` can be hidden from userland while the request body is still delivered. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.

HTTP Smuggling in cPanel allows potential leak of credentials.

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Apache Traffic Server versions 10.0.0 through 10.1.3 have a vulnerability where HTTP/2 origin trailers are forwarded to HTTP/1 clients without proper chunked framing during protocol conversion. This inconsistent interpretation of HTTP requests can lead to impacts on confidentiality, integrity, and availability. Upgrading to versions 9.2.15 or 10.1.4 resolves this issue.

Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 contain a vulnerability where Transfer-Encoding headers in HTTP/2 requests are not rejected. This flaw allows for downgrade request smuggling attacks. The issue is fixed in versions 9.2.15 and 10.1.4. The vulnerability has a critical CVSS score of 10.0.

Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 contain a vulnerability that allows HTTP request smuggling via malformed chunked messages. This vulnerability is identified as CWE-444 and has a critical CVSS score of 10. Users are advised to upgrade to versions 9.2.15 or 10.1.4 where the issue is fixed.

CVE-2026-24033 is a high-severity vulnerability in Apache Traffic Server involving inconsistent interpretation of HTTP requests, also known as HTTP Request/Response Smuggling. This affects versions from 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3. The vulnerability can lead to partial confidentiality and integrity impacts but does not affect availability. Users are advised to upgrade to versions 9.2.15 or 10.1.4 where the issue is fixed.