CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
baseThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (552)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-48710US | medium6.5OT critical | KEV | ||
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because… | ||||
| CVE-2025-61884US | —OT critical | KEV | ||
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vu… | ||||
| CVE-2023-48365US | critical9.9OT critical | KEV | ||
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attack… | ||||
| CVE-2023-41265US | critical9.9OT critical | KEV | ||
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch… | ||||
| CVE-2022-22536US | critical10.0OT critical | KEV | ||
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and… | ||||
| CVE-2023-25690US | critical9.8 | Exploit | ||
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.
Configurations are affected when mod_proxy is enabled a… | ||||
| CVE-2012-0124US | high10.0 | Exploit | ||
Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause… | ||||
| CVE-2007-1868US | high10.0 | Exploit | ||
The management service in IBM Tivoli Provisioning Manager for OS Deployment before 5.1 Fix Pack 2 does not properly handle multipart/form-data in HTTP POST requests, which allows r… | ||||
| CVE-2021-30180US | critical9.8 | Exploit | ||
Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request i… | ||||
| CVE-2006-1186US | high10.0 | Exploit | ||
Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via by instantiating the (1) Mdt2gddr.dll, (2) Mdt2dd.dll, and (3) Mdt2gddo.dll COM obj… | ||||
| CVE-2019-15605US | critical9.8 | Exploit | ||
HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed | ||||
| CVE-2021-40346US | high7.5 | Exploit | ||
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all config… | ||||
| CVE-2020-9490US | high7.5 | — | ||
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to… | ||||
| CVE-2022-22720US | critical9.8 | Exploit | ||
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling | ||||
| CVE-2022-32214US | medium6.5 | — | ||
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Sm… | ||||
| CVE-2022-29361US | critical9.8 | Exploit | ||
Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests includ… | ||||
| CVE-2005-1825US | high7.5 | — | ||
Multiple stack-based buffer overflows in the nvd_exec function in HP Radia Notify Daemon 3.1.2.0 (formerly by Novadigm), and other versions including 2.x, 3.x, and 4.x, allows remo… | ||||
| CVE-2022-32215US | medium6.5 | — | ||
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smug… | ||||
| CVE-2026-88773US | critical10.0 | Exploit | ||
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before… | ||||
| CVE-2022-2466US | critical9.8 | Exploit | ||
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. | ||||
03
attack patterns (2)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan