CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
371 vulnerabilities with CWE-444
CVE-2021-43669
HIGH
Hyperledger Fabric 1.4.0, 2.0.0, 2.0.1, 2.3.0 - Denial of Service via Invalid Order Header
CVSS 7.5
CVE-2021-22959
MEDIUM
llhttp < 2.1.4 - HTTP Request Smuggling via Header Name Parsing
CVSS 6.5
CVE-2021-43610
HIGH
Belle-sip < 5.0.20 - Denial of Service via Invalid From Header in SIP Message
CVSS 7.5
CVE-2021-22960
MEDIUM
llhttp < 2.1.4 and < 6.0.6 - HTTP Request Smuggling via Chunk Extension Parsing
CVSS 6.5
CVE-2021-37147
HIGH
Apache Traffic Server 8.0.0-8.1.2 and 9.0.0-9.1.0 - HTTP Request Smuggling via Header Parsing
CVSS 7.5
CVE-2021-29991
HIGH
Firefox < 91.0.1 - HTTP Request Smuggling via HTTP/3 Header Newline Injection
CVSS 8.1
CVE-2021-41136
LOW
Puma < 4.3.8 and 5.0.0-5.5.1 - HTTP Request Smuggling via LF Character in Forwarded Headers
CVSS 3.7
CVE-2021-41732
HIGH
zeek 4.1.0 - HTTP Request Smuggling
CVSS 7.5
CVE-2021-31923
MEDIUM
PingAccess < 5.3.3 - HTTP Request Smuggling via Header Manipulation
CVSS 5.3
CVE-2021-39214
HIGH
mitmproxy < 7.0.2 - HTTP Request Smuggling via Malicious Client/Server
CVSS 8.1
CVE-2021-38162
HIGH
SAP Web Dispatcher 7.49, 7.53, 7.77, 7.81 - Unauthenticated HTTP Request Smuggling
CVSS 8.9
CVE-2021-34559
MEDIUM
PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 - HTTP Request Smuggling
CVSS 5.4
CVE-2021-33056
HIGH
Belle-sip < 4.5.20 - Denial of Service via Invalid From Header
CVSS 7.5
CVE-2021-38512
HIGH
actix-http <3.0.0-beta.9 - Info Disclosure
CVSS 7.5
CVE-2021-32598
MEDIUM
FortiAnalyzer and FortiManager 5.6.0-7.0.0 - Authenticated HTTP Request Smuggling via CRLF Injection
CVSS 4.3
CVE-2021-36740
MEDIUM
Varnish-cache Varnish Cache < 6.0.8 - HTTP Request Smuggling
CVSS 6.5
CVE-2021-33683
MEDIUM
SAP Web Dispatcher and ICM - HTTP Request Smuggling
CVSS 4.3
CVE-2021-33037
MEDIUM
Apache Tomcat <10.0.7-8.5.67 - Info Disclosure
CVSS 5.3
CVE-2021-32715
LOW
hyper < 0.14.10 - HTTP Request Smuggling via Malformed Content-Length Header
CVSS 3.1
CVE-2021-32565
HIGH
Apache Traffic Server 7.0.0-7.1.12, 8.0.0-8.1.1, 9.0.0-9.0.1 - HTTP Request Smuggling via Content-Length Header
CVSS 7.5
CVE-2021-27577
HIGH
Apache Traffic Server <9.0.2 - Info Disclosure
CVSS 7.5
CVE-2021-30180
CRITICAL
Apache Dubbo < 2.7.10 - Remote Code Execution via Tag Routing YAML Parsing
CVSS 9.8
CVE-2021-31922
HIGH
Pulse Secure Virtual Traffic Manager < 21.1 - HTTP Request Smuggling via HTTP/2 Header
CVSS 7.5
CVE-2021-21409
MEDIUM
Netty < 4.1.61 - HTTP Request Smuggling via Single Http2HeaderFrame
CVSS 5.9
CVE-2021-21295
MEDIUM
Netty < 4.1.60 - HTTP Request Smuggling via HTTP/2 to HTTP/1.1 Conversion
CVSS 5.9
Details
Vulnerabilities
371