CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Parent: CWE-436 - Interpretation Conflict

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

371 vulnerabilities with CWE-444
CVE-2021-43669 HIGH
Hyperledger Fabric 1.4.0, 2.0.0, 2.0.1, 2.3.0 - Denial of Service via Invalid Order Header
CVSS 7.5
CVE-2021-22959 MEDIUM
llhttp < 2.1.4 - HTTP Request Smuggling via Header Name Parsing
CVSS 6.5
CVE-2021-43610 HIGH
Belle-sip < 5.0.20 - Denial of Service via Invalid From Header in SIP Message
CVSS 7.5
CVE-2021-22960 MEDIUM
llhttp < 2.1.4 and < 6.0.6 - HTTP Request Smuggling via Chunk Extension Parsing
CVSS 6.5
CVE-2021-37147 HIGH
Apache Traffic Server 8.0.0-8.1.2 and 9.0.0-9.1.0 - HTTP Request Smuggling via Header Parsing
CVSS 7.5
CVE-2021-29991 HIGH
Firefox < 91.0.1 - HTTP Request Smuggling via HTTP/3 Header Newline Injection
CVSS 8.1
CVE-2021-41136 LOW
Puma < 4.3.8 and 5.0.0-5.5.1 - HTTP Request Smuggling via LF Character in Forwarded Headers
CVSS 3.7
CVE-2021-41732 HIGH
zeek 4.1.0 - HTTP Request Smuggling
CVSS 7.5
CVE-2021-31923 MEDIUM
PingAccess < 5.3.3 - HTTP Request Smuggling via Header Manipulation
CVSS 5.3
CVE-2021-39214 HIGH
mitmproxy < 7.0.2 - HTTP Request Smuggling via Malicious Client/Server
CVSS 8.1
CVE-2021-38162 HIGH
SAP Web Dispatcher 7.49, 7.53, 7.77, 7.81 - Unauthenticated HTTP Request Smuggling
CVSS 8.9
CVE-2021-34559 MEDIUM
PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 - HTTP Request Smuggling
CVSS 5.4
CVE-2021-33056 HIGH
Belle-sip < 4.5.20 - Denial of Service via Invalid From Header
CVSS 7.5
CVE-2021-38512 HIGH
actix-http <3.0.0-beta.9 - Info Disclosure
CVSS 7.5
CVE-2021-32598 MEDIUM
FortiAnalyzer and FortiManager 5.6.0-7.0.0 - Authenticated HTTP Request Smuggling via CRLF Injection
CVSS 4.3
CVE-2021-36740 MEDIUM
Varnish-cache Varnish Cache < 6.0.8 - HTTP Request Smuggling
CVSS 6.5
CVE-2021-33683 MEDIUM
SAP Web Dispatcher and ICM - HTTP Request Smuggling
CVSS 4.3
CVE-2021-33037 MEDIUM
Apache Tomcat <10.0.7-8.5.67 - Info Disclosure
CVSS 5.3
CVE-2021-32715 LOW
hyper < 0.14.10 - HTTP Request Smuggling via Malformed Content-Length Header
CVSS 3.1
CVE-2021-32565 HIGH
Apache Traffic Server 7.0.0-7.1.12, 8.0.0-8.1.1, 9.0.0-9.0.1 - HTTP Request Smuggling via Content-Length Header
CVSS 7.5
CVE-2021-27577 HIGH
Apache Traffic Server <9.0.2 - Info Disclosure
CVSS 7.5
CVE-2021-30180 CRITICAL
Apache Dubbo < 2.7.10 - Remote Code Execution via Tag Routing YAML Parsing
CVSS 9.8
CVE-2021-31922 HIGH
Pulse Secure Virtual Traffic Manager < 21.1 - HTTP Request Smuggling via HTTP/2 Header
CVSS 7.5
CVE-2021-21409 MEDIUM
Netty < 4.1.61 - HTTP Request Smuggling via Single Http2HeaderFrame
CVSS 5.9
CVE-2021-21295 MEDIUM
Netty < 4.1.60 - HTTP Request Smuggling via HTTP/2 to HTTP/1.1 Conversion
CVSS 5.9
Details
Vulnerabilities 371