CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
370 vulnerabilities with CWE-444
CVE-2025-61884
HIGH
KEV
Oracle Configurator 12.2.3-12.2.14 - Unauthenticated CRLF Injection via Runtime UI
CVSS 7.5
CVE-2025-59822
HIGH
http4s < 0.23.31 - HTTP Request Smuggling via Trailer Header Mishandling
CVSS 7.5
CVE-2025-6999
MEDIUM
WatchGuard Fireware OS <12.11.2 - XSS
CVE-2025-56266
CRITICAL
Avigilon Access Control Manager 7.10.0.20 - Remote Code Execution via Host Header Injection
CVSS 9.8
CVE-2025-58056
HIGH
Netty < 4.1.125 - HTTP Request Smuggling via Inconsistent Chunked Transfer Encoding
CVSS 7.5
CVE-2025-58068
CRITICAL
eventlet < 0.40.3 - HTTP Request Smuggling via WSGI Trailer Handling
CVSS 9.1
CVE-2025-54142
MEDIUM
Akamai Ghost <2025-07-21 - HTTP Request Smuggling
CVSS 4.0
CVE-2025-32094
MEDIUM
Akamai Ghost < 2025-03-26 - HTTP Request Smuggling via Obsolete Line Folding
CVSS 4.0
CVE-2025-52892
MEDIUM
EspoCRM < 9.1.7 - Denial of Service via Double Slash URL Path
CVSS 4.5
CVE-2025-53643
HIGH
AIOHTTP <3.12.14 - Request Smuggling
CVSS 7.5
CVE-2025-53628
HIGH
cpp-httplib <0.20.1 - Memory Corruption
CVSS 8.8
CVE-2025-49826
HIGH
Next.js 15.0.4-15.1.8 - Denial of Service via HTTP 204 Response Cache Poisoning
CVSS 7.5
CVE-2025-49005
LOW
Next.js 15.3.0-15.3.3 and Vercel CLI 41.4.1-42.2.0 - Cache Poisoning via HTML/RSC Content Type Confusion
CVSS 3.7
CVE-2025-6442
MEDIUM
Ruby WEBrick < 1.8.2 - HTTP Request Smuggling via Header Terminator Parsing
CVSS 5.9
CVE-2025-41235
HIGH
Spring Cloud Gateway Server 4.2.0-4.2.2 - HTTP Request Smuggling via Forwarded Header Handling
CVSS 8.6
CVE-2025-4366
MEDIUM
Pingora < 0.5.0 - HTTP Request Smuggling via Cache HIT Request Body Manipulation
CVSS 6.1
CVE-2025-23167
MEDIUM
Node.js 20 < 20.19.1 - HTTP Request Smuggling via Improper Header Termination
CVSS 6.5
CVE-2025-4600
HIGH
Google Cloud Classic Application Load Balancer < 2025-04-26 - HTTP Request Smuggling via Chunked Encoding
CVSS 7.5
CVE-2025-47905
MEDIUM
Varnish Cache <7.6.3-7.7.1 & Varnish Enterprise <6.0.13r14 - Open R...
CVSS 5.4
CVE-2025-43859
CRITICAL
Pypi H11 < 0.16.0 - HTTP Request Smuggling
CVSS 9.1
CVE-2025-1386
MEDIUM
ClickHouse ch-go < 0.65.0 - HTTP Request Smuggling via Malicious External Data
CVSS 4.9
CVE-2025-31137
HIGH
React Router 7.0.0-7.4.0 and Remix 2.11.1-2.16.2 - HTTP Request Smuggling via Host Header
CVSS 7.5
CVE-2025-30346
MEDIUM
Varnish Cache <7.6.2 - Open Redirect
CVSS 5.4
CVE-2025-29904
MEDIUM
JetBrains Ktor < 3.1.1 - HTTP Request Smuggling
CVSS 5.3
CVE-2025-1867
CRITICAL
libhv <= 1.3.3 - HTTP Response Smuggling
Details
Vulnerabilities
370