CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
315 vulnerabilities with CWE-444
CVE-2026-39805
MEDIUM
CL.CL HTTP request smuggling via duplicate Content-Length in bandit
CVE-2026-40560
HIGH
Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence
CVSS 7.5
CVE-2026-41873
CRITICAL
Pony Mail: Admin account takeover via request smuggling
CVSS 9.8
CVE-2026-2708
LOW
Libsoup: libsoup: http request smuggling via duplicate content-length headers
CVSS 3.7
CVE-2026-2332
HIGH
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
CVSS 7.4
CVE-2026-40175
MEDIUM
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
CVSS 4.8
CVE-2026-24880
HIGH
Apache Tomcat: Request smuggling via invalid chunk extension
CVSS 7.5
CVE-2026-31842
HIGH
Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling
CVSS 7.5
CVE-2026-34525
MEDIUM
AIOHTTP: Duplicate Host header accepted
CVSS 5.3
CVE-2026-2862
MEDIUM
Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
CVSS 5.3
CVE-2026-1491
MEDIUM
Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
CVSS 5.3
CVE-2026-34441
MEDIUM
cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body
CVSS 4.8
CVE-2026-33870
HIGH
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
CVSS 7.5
CVE-2026-28369
HIGH
Undertow: undertow: request smuggling via malformed http request headers
CVSS 8.7
CVE-2026-28368
HIGH
Undertow: undertow: request smuggling via inconsistent header parsing
CVSS 8.7
CVE-2026-28367
HIGH
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
CVSS 8.7
CVE-2026-4742
LOW
HTTP Request Smuggling in visualfc/liteide
CVE-2026-29057
MEDIUM
Next.js: HTTP request smuggling in rewrites
CVSS 6.5
CVE-2026-23941
HIGH
Erlang OTP inets httpd - HTTP Request Smuggling
CVE-2026-32240
MEDIUM
Cap'n Proto <1.4.0 - HTTP Smuggling
CVSS 6.5
CVE-2026-32239
MEDIUM
Cap'n Proto has an integer overflow in KJ-HTTP
CVSS 6.5
CVE-2026-1525
MEDIUM
Undici - HTTP Request Smuggling
CVSS 6.5
CVE-2026-28497
CRITICAL
TinyWeb <2.03 - HTTP Request Smuggling
CVSS 9.1
CVE-2026-2835
CRITICAL
Pingora - HTTP Request Smuggling
CVSS 9.1
CVE-2026-2833
CRITICAL
Pingora - HTTP Request Smuggling
CVSS 9.1
Details
Vulnerabilities
315