CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
334 vulnerabilities with CWE-444
CVE-2020-35884
MEDIUM
tiny-http < 0.8.0 - HTTP Request Smuggling via Malformed Transfer-Encoding Header
CVSS 6.5
CVE-2020-35863
CRITICAL
hyper < 0.12.34 - HTTP Request Smuggling
CVSS 9.8
CVE-2020-26281
MEDIUM
async-h1 <2.3.0 - Request Smuggling
CVSS 6.8
CVE-2020-28361
MEDIUM
Kamailio < 5.4.0 - HTTP Request Smuggling via Whitespace Bypass in remove_hf Function
CVSS 5.4
CVE-2020-26129
MEDIUM
JetBrains Ktor < 1.4.1 - HTTP Request Smuggling
CVSS 6.5
CVE-2020-7764
MEDIUM
find-my-way <2.2.5 & 3.0.0-3.0.5 - DoS
CVSS 5.9
CVE-2020-25613
HIGH
Ruby WEBrick < 1.6.0 - HTTP Request Smuggling via Transfer-Encoding Header
CVSS 7.5
CVE-2020-10687
MEDIUM
Undertow < 2.2.0.Final - HTTP Request Smuggling via Invalid Characters in HTTP Request
CVSS 4.8
CVE-2020-8201
HIGH
Node.js < 12.18.4-14.11 - Open Redirect
CVSS 7.4
CVE-2020-15810
MEDIUM
Squid < 4.13 and 5.x < 5.0.4 - HTTP Request Smuggling via Relaxed Header Parsing
CVSS 6.5
CVE-2020-9490
HIGH
Apache HTTP Server 2.4.20-2.4.43 - Denial of Service via Crafted Cache-Digest Header
CVSS 7.5
CVE-2020-11993
HIGH
Apache HTTP Server 2.4.20-2.4.43 - HTTP Request Smuggling via HTTP/2 Module Logging
CVSS 7.5
CVE-2020-15049
CRITICAL
Squid < 4.12 and 5.x < 5.0.3 - HTTP Request Smuggling via Content-Length Header
CVSS 9.9
CVE-2020-7671
HIGH
goliath < 1.0.6 - HTTP Request Smuggling via Duplicate Content-Length Header
CVSS 7.5
CVE-2020-7670
HIGH
agoo < 2.14.0 - HTTP Request Smuggling via Incorrect Content-Length and Transfer Encoding Parsing
CVSS 7.5
CVE-2020-7659
HIGH
reel < 0.6.1 - HTTP Request Smuggling via Content-Length and Transfer Encoding Header Parsing
CVSS 7.5
CVE-2020-10719
MEDIUM
Undertow < 2.1.1 - HTTP Request Smuggling via Invalid Chunk Size Handling
CVSS 6.5
CVE-2020-7658
MEDIUM
meinheld < 1.0.2 - HTTP Request Smuggling via Incorrect Header Parsing
CVSS 6.1
CVE-2020-11077
MEDIUM
Puma 3.0.0-3.12.5 - HTTP Request Smuggling via Proxy Connection Reuse
CVSS 6.8
CVE-2020-11076
HIGH
Puma 3.0.0-3.12.5 and 4.0.0-4.3.3 - HTTP Request Smuggling via Invalid Transfer-Encoding Header
CVSS 7.5
CVE-2020-7655
MEDIUM
netius < 1.17.58 - HTTP Request Smuggling via Transfer-Encoding Header Parsing
CVSS 6.1
CVE-2020-11506
HIGH
GitLab 10.7.0-12.9.2 - Exposure of Sensitive Information via Workhorse Request Smuggling
CVSS 7.5
CVE-2020-11505
HIGH
GitLab < 12.7.9, 12.8.x < 12.8.9, 12.9.x < 12.9.3 - Exposure of Sensitive Information via Workhorse Request Smuggling
CVSS 7.5
CVE-2020-11724
HIGH
OpenResty < 1.15.8.4 - HTTP Request Smuggling via ngx.location.capture API
CVSS 7.5
CVE-2020-7611
CRITICAL
Micronaut < 1.2.11 and 1.3.0-1.3.2 - HTTP Request Header Injection
CVSS 9.8
Details
Vulnerabilities
334