CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability

Apache Tomcat Improper Input Validation vulnerability

Hono vulnerable to Vary Header Injection leading to potential CORS Bypass

undici vulnerable to downstream response splitting via retry interceptor

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`

sanic chunked trailer request smuggling allows hidden second request execution

Http4s: Ember chunk parser lenience (TE.TE request smuggling)

Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

SAP Approuter Vulnerable to HTTP Request Smuggling

vLLM: OpenAI auth bypass

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability

h2: Duplicate Host header could facilitate request smuggling

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool