Inconsistent interpretation of HTTP requests in hono - CVE-2026-84363

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU146050

Inconsistent interpretation of HTTP requests in hono - CVE-2026-84363

Published: August 28, 2026 / Updated: September 2, 2026


Vulnerability identifier: #VU146050
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84363
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass filtering or cache unsafe responses.

The vulnerability exists due to inconsistent interpretation of HTTP requests in the query parser and cache middleware when processing request targets containing a literal fragment followed by query parameters. A remote attacker can send a specially crafted request to bypass filtering or cache unsafe responses.

Only deployments where a literal # reaches the application are affected; runtimes or intermediaries that normalize or strip the fragment are not affected.


Affected software

hono
IBM App Connect Enterprise

How to mitigate CVE-2026-84363

Install security update from vendor's website.

hono - update to 4.13.5
IBM App Connect Enterprise - update to 13.0.9.0

External References

Related Security Bulletins