CWE-444 · Injection and Smuggling
Inconsistent Interpretation of HTTP Requests
441CVEs
4exploited
2with a public check
24likely (EPSS 10%+)
SortMost likely exploited
441 CVEs with CWE-444 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-22536In CISA KEVExploitedSAP Memory Pipes (MPI) DesynchronizationSAP SE · SAP NetWeaver and ABAP Platform · CVSS 9.8 · 2022-02-09 | 9.8 | 98% | 2022-02-09 |
| CVE-2023-41265In CISA KEVExploitedQlik Sense Enterprise - HTTP Request SmugglingQlik · Sense · CVSS 9.6 · 2023-08-29 | 9.6 | 88% | 2023-08-29 |
| CVE-2026-48710In CISA KEVExploitedStarlette - Improper Validation of Unsafe Equivalence in InputKludex · starlette · CVSS 6.5 · 2026-05-26 | 6.5 | 70% | 2026-05-26 |
| CVE-2023-48365In CISA KEVExploitedQlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attac…Qlik · Sense · CVSS 9.6 · 2023-11-15 | 9.6 | 48% | 2023-11-15 |
| CVE-2025-56266CheckAvigilon ACM - Host Header InjectionAvigilon · Access Control Manager · CVSS 9.8 · 2025-09-08 | 9.8 | 3.0% | 2025-09-08 |
| CVE-2023-33193CheckEmby Server - Authentication BypassEmbySupport · security · CVSS 9.1 · 2023-05-30 | 9.1 | 1.7% | 2023-05-30 |
| CVE-2020-9490Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to…Apache · Apache HTTP Server · 2020-08-07 | – | 89% | 2020-08-07 |
| CVE-2023-25690Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxyApache Software Foundation · Apache HTTP Server · CVSS 9.8 · 2023-03-07 | 9.8 | 84% | 2023-03-07 |
| CVE-2022-32214The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request S…NodeJS · Node · 2022-07-14 | – | 82% | 2022-07-14 |
| CVE-2021-33037Incorrect Transfer-Encoding handling with HTTP/1.0Apache Software Foundation · Apache Tomcat · 2021-07-12 | – | 75% | 2021-07-12 |
| CVE-2022-32215The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smu…NodeJS · Node · 2022-07-14 | – | 70% | 2022-07-14 |
| CVE-2025-55315ASP.NET Security Feature Bypass VulnerabilityMicrosoft · ASP.NET Core 2.3 · CVSS 9.9 · 2025-10-14 | 9.9 | 67% | 2025-10-14 |
| CVE-2021-30180Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)Apache Software Foundation · Apache Dubbo · 2021-05-31 | – | 60% | 2021-05-31 |
| CVE-2019-17567mod_proxy_wstunnel tunneling of non Upgraded connectionsApache Software Foundation · Apache HTTP Server · 2021-06-10 | – | 60% | 2021-06-10 |
| CVE-2019-15605HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformedNodeJS · Node · 2020-02-07 | – | 57% | 2020-02-07 |
| CVE-2020-11993Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong con…Apache · Apache HTTP Server · 2020-08-07 | – | 57% | 2020-08-07 |
| CVE-2022-21826Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Lengt…Ivanti · Pulse Connect Secure VPN Server · 2022-09-30 | – | 46% | 2022-09-30 |
| CVE-2022-32213The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smug…NodeJS · Node · 2022-07-14 | – | 45% | 2022-07-14 |
| CVE-2021-23336Web Cache PoisoningPython · python/cpython · CVSS 5.9 · 2021-02-15 | 5.9 | 41% | 2021-02-15 |
| CVE-2005-2089Microsoft IIS 5.0 and 6.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Tra…Microsoft · Internet Information Services · 2005-06-30 | – | 31% | 2005-06-30 |
| CVE-2022-22720HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlierApache Software Foundation · Apache HTTP Server · 2022-03-14 | – | 28% | 2022-03-14 |
| CVE-2022-26377mod_proxy_ajp: Possible request smugglingApache Software Foundation · Apache HTTP Server · 2022-06-08 | – | 21% | 2022-06-08 |
| CVE-2005-2088The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall prote…Apache · Http Server · 2005-06-30 | – | 20% | 2005-06-30 |
| CVE-2017-7658In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths header…The Eclipse Foundation · Eclipse Jetty · 2018-06-26 | – | 19% | 2018-06-26 |
| CVE-2021-21295Possible request smuggling in HTTP/2 due missing validationnetty · io.netty:netty-codec-http2 · CVSS 5.9 · 2021-03-09 | 5.9 | 19% | 2021-03-09 |
| CVE-2020-8287Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, N…NodeJS · Node · 2021-01-06 | – | 16% | 2021-01-06 |
| CVE-2019-20372NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environ…F5 · Nginx · 2020-01-09 | – | 15% | 2020-01-09 |
| CVE-2017-7657In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled…The Eclipse Foundation · Eclipse Jetty · 2018-06-26 | – | 14% | 2018-06-26 |
| CVE-2019-20445HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.Netty · Netty · 2020-01-29 | – | 14% | 2020-01-29 |
| CVE-2019-18277A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact w…Haproxy · Haproxy · 2019-10-23 | – | 10% | 2019-10-23 |
| CVE-2015-5739The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attack…Golang · Go · 2017-10-18 | – | 9.6% | 2017-10-18 |
| CVE-2020-1935In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP header…Apache · Apache Tomcat · 2020-02-24 | – | 9.4% | 2020-02-24 |
| CVE-2019-20444HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be inter…Netty · Netty · 2020-01-29 | – | 8.9% | 2020-01-29 |
| CVE-2019-17569The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-En…Apache · Apache Tomcat · 2020-02-24 | – | 8.9% | 2020-02-24 |
| CVE-2019-16869Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.Netty · Netty · 2019-09-26 | – | 8.6% | 2019-09-26 |
| CVE-2019-0197A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request fro…Apache Software Foundation · Apache HTTP Server · 2019-06-11 | – | 8.3% | 2019-06-11 |
| CVE-2022-29361Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with multiple requests inclu…Palletsprojects · Werkzeug · 2022-05-24 | – | 8.1% | 2022-05-24 |
| CVE-2020-25097An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access serv…Squid-Cache · Squid · 2021-03-19 | – | 7.3% | 2021-03-19 |
| CVE-2023-46846Squid: request/response smuggling in http/1.1 and icapRed Hat · Red Hat Enterprise Linux 7 Extended Lifecycle Support · CVSS 9.3 · 2023-11-03 | 9.3 | 7.2% | 2023-11-03 |
| CVE-2017-15643An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IKARUS AV for Windows uses cleartext HTTP for updates along wi…Ikarussecurity · Ikarus Antivirus · 2017-10-19 | – | 6.4% | 2017-10-19 |
| CVE-2018-8004There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2…Apache Software Foundation · Apache Traffic Server · 2018-08-29 | – | 6.2% | 2018-08-29 |
| CVE-2019-18678An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request p…Squid-Cache · Squid · 2019-11-26 | – | 6.2% | 2019-11-26 |
| CVE-2017-7656In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/…The Eclipse Foundation · Eclipse Jetty · 2018-06-26 | – | 6.1% | 2018-06-26 |
| CVE-2023-25725HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAP…Haproxy · Haproxy · CVSS 9.1 · 2023-02-14 | 9.1 | 5.5% | 2023-02-14 |
| CVE-2020-15049An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache.…Squid-Cache · Squid · CVSS 9.9 · 2020-06-30 | 9.9 | 5.3% | 2020-06-30 |
| CVE-2020-8201Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to h…NodeJS · Node · 2020-09-18 | – | 5.3% | 2020-09-18 |
| CVE-2019-16276Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.Golang · Go · 2019-09-30 | – | 5.3% | 2019-09-30 |
| CVE-2021-41436An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDITION, RT-AX86 Series…Asus · Gt-Ax11000 Firmware · 2021-11-19 | – | 5.0% | 2021-11-19 |
| CVE-2021-21409Possible request smuggling in HTTP/2 due missing validation of content-lengthnetty · netty · CVSS 5.9 · 2021-03-30 | 5.9 | 4.9% | 2021-03-30 |
| CVE-2021-21299Multiple Transfer-Encoding headers misinterprets request payloadhyperium · hyper · CVSS 4.8 · 2021-02-11 | 4.8 | 4.8% | 2021-02-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.