CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Description

When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being aware of it.

Latest vulnerabilities for CWE-444

Multiple vulnerabilities in IBM Security Directory Suite 2024-12-02
High Yes

Multiple vulnerabilities in IBM Process Mining 2024-11-28
High Yes Public exploit

Multiple vulnerabilities in IBM QRadar User Behavior Analytics 2024-11-28
High Yes

HTTP request smuggling in HAProxy 2024-11-27
Medium Yes

Multiple vulnerabilities in aiohttp 2024-11-19
Medium Yes

Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM) 2024-11-15
High Yes Public exploit

HTTP request smuggling in GNOME libsoup 2024-11-13
Medium Yes

Multiple vulnerabilities in IBM Cognos Analytics 2024-11-08
High Yes Public exploit

Multiple vulnerabilities in IBM Control Center 2024-11-08
Medium Yes Public exploit

Multiple vulnerabilities in Waitress 2024-11-01
Medium Yes

References

Description of CWE-444 on Mitre website