CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Parent: CWE-436 - Interpretation Conflict

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

334 vulnerabilities with CWE-444
CVE-2024-52304 HIGH
aiohttp <3.10.11 - Request Smuggling
CVSS 7.5
CVE-2024-52530 HIGH
GNOME libsoup < 3.6.0 - HTTP Request Smuggling via Null Byte in Header Names
CVSS 7.5
CVE-2024-49768 CRITICAL
Waitress 2.0.0-3.0.0 - Time-of-check Time-of-use Race Condition via HTTP Pipelining
CVSS 9.1
CVE-2024-44775 HIGH
kmqtt 0.2.7 - Denial of Service via Crafted MQTT CONNECT Packet
CVSS 7.5
CVE-2024-21281 MEDIUM
Oracle Banking Liquidity Management 14.7.0.6.0 - HTTP Request Smuggling
CVSS 5.3
CVE-2024-8912 HIGH
Google Cloud Looker 23.12-23.12.122 - Unauthenticated HTTP Request Smuggling
CVSS 7.5
CVE-2024-9622 MEDIUM
resteasy-netty4-cdi - Denial of Service via HTTP Request Smuggling
CVSS 5.3
CVE-2024-8925 LOW
PHP 8.1.0-8.1.29 - HTTP Request Smuggling via Multipart Form Data Parsing
CVSS 3.1
CVE-2024-34535 MEDIUM
Mastodon < 4.1.16 - HTTP Request Smuggling via Crafted Header
CVSS 5.9
CVE-2024-45614 MEDIUM
Puma < 5.6.9 - Authorization Bypass via Underscore Header Clobbering
CVSS 5.4
CVE-2024-42342 MEDIUM
Loway QueueMetrics 22.11.6-24.05.5 - HTTP Request Smuggling
CVSS 4.3
CVE-2024-27185 CRITICAL
Joomla Pagination - Cache Poisoning
CVSS 9.1
CVE-2024-35538 MEDIUM
Typecho 1.3.0 - Client IP Spoofing via X-Forwarded-For or Client-Ip Headers
CVSS 5.3
CVE-2024-41671 HIGH
Twisted < 24.7.0rc1 - HTTP Request Smuggling via Pipelined Request Mismanagement
CVSS 8.3
CVE-2024-35161 HIGH
Apache Traffic Server 8.0.0-8.1.10 and 9.0.0-9.2.4 - HTTP Request Smuggling via Malformed Chunked Trailer
CVSS 7.5
CVE-2024-41110 CRITICAL
Docker 19.03.0-27.1.0 - Authorization Bypass via API Request Body Omission
CVSS 9.9
CVE-2024-38494 HIGH
Broadcom Symantec PAM 3.4.6 and 4.1.0-4.1.7 - Authenticated Remote Command Execution
CVE-2024-22279 MEDIUM
Cloud Foundry <0.297.0 - DoS
CVSS 5.9
CVE-2024-23326 MEDIUM
Envoy < 1.27.6 - Request Smuggling via Incorrect Protocol Upgrade Handling
CVSS 5.9
CVE-2024-23316 HIGH
Ping Identity PingAccess <8.0.1 - Open Redirect
CVE-2024-34350 HIGH
Next.js 13.4.0-13.5.0 - HTTP Request Smuggling via Rewrites Feature
CVSS 7.5
CVE-2024-27982 MEDIUM
Node < 18.20.1, 19.x, < 20.12.1, < 21.7.2 - HTTP Request Smuggling via Malformed Content-Length Header
CVSS 6.5
CVE-2024-32638 MEDIUM
Apache APISIX 3.8.0-3.9.0 - HTTP Request Smuggling via Forward-Auth Plugin
CVSS 6.3
CVE-2024-21088 HIGH
Oracle E-Business Suite 12.2.4-12.2.12 - Unauthenticated HTTP Request Smuggling in Import Utility
CVSS 7.5
CVE-2024-1135 HIGH
Gunicorn < 22.0.0 - HTTP Request Smuggling via Transfer-Encoding Header Mismanagement
CVSS 7.5
Details
Vulnerabilities 334