CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
370 vulnerabilities with CWE-444
CVE-2026-1525
MEDIUM
Undici < 6.24.0 - HTTP Request Smuggling via Duplicate Content-Length Headers
CVSS 6.5
CVE-2026-28497
CRITICAL
TinyWeb <2.03 - HTTP Request Smuggling
CVSS 9.1
CVE-2026-2835
CRITICAL
Pingora < 0.8.0 - HTTP Request Smuggling via HTTP/1.0 Transfer-Encoding Handling
CVSS 9.1
CVE-2026-2833
CRITICAL
Pingora < 0.8.0 - HTTP Request Smuggling via Upgrade Header Handling
CVSS 9.1
CVE-2026-20069
MEDIUM
Cisco Secure Firewall ASA and FTD - HTTP Request Smuggling via VPN Web Services
CVSS 4.3
CVE-2026-26365
MEDIUM
Akamai Ghost - HTTP Request Smuggling
CVSS 4.0
CVE-2026-1801
MEDIUM
libsoup - HTTP Request Smuggling Information Disclosure
CVSS 5.3
CVE-2026-1760
MEDIUM
SoupServer - HTTP Request Smuggling
CVSS 5.3
CVE-2026-1002
MEDIUM
Eclipse Vert.x Web - Static File Access Denial via URI Path Manipulation
CVSS 5.3
CVE-2026-23527
HIGH
h3 < 1.15.5 - HTTP Request Smuggling via Transfer-Encoding Header Case Mismatch
CVSS 8.9
CVE-2025-3110
HIGH
Openvpn Access Server < 3.1.0 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CVSS 7.5
CVE-2025-31958
LOW
HCL BigFix Service Management (SM) is susceptible to HTTP Request Smuggling
CVSS 3.7
CVE-2025-65114
HIGH
Apache Traffic Server: Malformed chunked message body allows request smuggling
CVSS 7.5
CVE-2025-12811
MEDIUM
Delinea Cloud Suite - HTTP Request Smuggling
CVE-2025-55018
MEDIUM
Fortinet FortiOS 7.6.0, 7.4.0-7.4.9, 7.2.0-7.2.12, 7.0.0-7.0.18, 6.4.3-6.4.15 - HTTP Request Smuggling
CVSS 5.8
CVE-2025-41082
MEDIUM
Altitude Communication Server - SSRF
CVE-2025-69225
MEDIUM
aiohttp < 3.13.3 - HTTP Request Smuggling via Range Header
CVSS 5.3
CVE-2025-69224
MEDIUM
aiohttp < 3.13.3 - HTTP Request Smuggling via Non-ASCII Character Bypass
CVSS 6.5
CVE-2025-12874
MEDIUM
Quest Coexistence Manager for Notes <3.8.2045 - SSRF
CVE-2025-14523
HIGH
Red Hat Enterprise Linux - HTTP Request Smuggling via Duplicate Host Header Handling
CVSS 8.2
CVE-2025-61258
HIGH
Outsystems Platform Server <11.18.1.37828 - DoS
CVSS 7.5
CVE-2025-66373
MEDIUM
Akamai Ghost < 2025-11-17 - HTTP Request Smuggling via Chunked Body Size Mismatch
CVSS 4.8
CVE-2025-12642
CRITICAL
lighttpd 1.4.80 - HTTP Header Smuggling
CVSS 9.1
CVE-2025-11915
MEDIUM
Google Cloud Vertex AI: Partner Models for MaaS - HTTP Request Smuggling via Proxy Desynchronization
CVE-2025-55315
CRITICAL
ASP.NET Core 2.3.0-2.3.5 - HTTP Request Smuggling via Inconsistent Request Interpretation
CVSS 9.9
Details
Vulnerabilities
370