CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Parent: CWE-436 - Interpretation Conflict

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

334 vulnerabilities with CWE-444
CVE-2021-33056 HIGH
Belle-sip < 4.5.20 - Denial of Service via Invalid From Header
CVSS 7.5
CVE-2021-38512 HIGH
actix-http <3.0.0-beta.9 - Info Disclosure
CVSS 7.5
CVE-2021-32598 MEDIUM
FortiAnalyzer and FortiManager 5.6.0-7.0.0 - Authenticated HTTP Request Smuggling via CRLF Injection
CVSS 4.3
CVE-2021-36740 MEDIUM
Varnish-cache Varnish Cache < 6.0.8 - HTTP Request Smuggling
CVSS 6.5
CVE-2021-33683 MEDIUM
SAP Web Dispatcher and ICM - HTTP Request Smuggling
CVSS 4.3
CVE-2021-33037 MEDIUM
Apache Tomcat <10.0.7-8.5.67 - Info Disclosure
CVSS 5.3
CVE-2021-32715 LOW
hyper < 0.14.10 - HTTP Request Smuggling via Malformed Content-Length Header
CVSS 3.1
CVE-2021-32565 HIGH
Apache Traffic Server 7.0.0-7.1.12, 8.0.0-8.1.1, 9.0.0-9.0.1 - HTTP Request Smuggling via Content-Length Header
CVSS 7.5
CVE-2021-27577 HIGH
Apache Traffic Server <9.0.2 - Info Disclosure
CVSS 7.5
CVE-2021-30180 CRITICAL
Apache Dubbo < 2.7.10 - Remote Code Execution via Tag Routing YAML Parsing
CVSS 9.8
CVE-2021-31922 HIGH
Pulse Secure Virtual Traffic Manager < 21.1 - HTTP Request Smuggling via HTTP/2 Header
CVSS 7.5
CVE-2021-21409 MEDIUM
Netty < 4.1.61 - HTTP Request Smuggling via Single Http2HeaderFrame
CVSS 5.9
CVE-2021-21295 MEDIUM
Netty < 4.1.60 - HTTP Request Smuggling via HTTP/2 to HTTP/1.1 Conversion
CVSS 5.9
CVE-2021-20220 MEDIUM
Undertow < 2.0.34 and 2.1.0-2.1.6 - HTTP Request Smuggling via Invalid Character Handling
CVSS 4.8
CVE-2021-23339 MEDIUM
Akka-http-core <10.1.14, 10.2.0-10.2.4 - SSRF
CVSS 5.0
CVE-2021-23336 MEDIUM
Python/cpython <3.6.13, <3.7.10, <3.8.8, <3.9.2 - Web Cache Poisoning
CVSS 5.9
CVE-2021-21299 MEDIUM
hyper 0.12.0-0.13.9 and 0.14.0-0.14.2 - HTTP Request Smuggling via Transfer-Encoding Header Mismanagement
CVSS 4.8
CVE-2021-22293 HIGH
Huawei CampusInsight V100R019C10 - HTTP Request Smuggling
CVSS 7.5
CVE-2021-25762 MEDIUM
JetBrains Ktor < 1.4.3 - HTTP Request Smuggling
CVSS 5.3
CVE-2021-21445 MEDIUM
SAP Commerce Cloud 1808, 1811, 1905, 2005, 2011 - HTTP Response Smuggling via Content Type Header
CVSS 5.4
CVE-2020-25097 HIGH
Squid 2.0-4.13 and 5.0-5.0.4 - HTTP Request Smuggling via uri_whitespace Configuration
CVSS 8.6
CVE-2020-28483 HIGH
gin-gonic/gin - HTTP Request Smuggling via X-Forwarded-For Header
CVSS 7.1
CVE-2020-28473 MEDIUM
bottle < 0.12.19 - Web Cache Poisoning via Parameter Cloaking
CVSS 6.8
CVE-2020-17509 HIGH
Apache Traffic Server <8.1.0 - Cache Poisoning
CVSS 7.5
CVE-2020-8287 MEDIUM
Node.js <10.23.1, 12.20.1, 14.15.4, 15.5.1 - SSRF
CVSS 6.5
Details
Vulnerabilities 334