CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS
Percentile
72.6%
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
Vendor | Product | Version | CPE |
---|---|---|---|
llhttp | llhttp | * | cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:node.js:*:* |
llhttp | llhttp | * | cpe:2.3:a:llhttp:llhttp:*:*:*:*:*:*:*:* |
nodejs | node.js | * | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
nodejs | node.js | * | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
fedoraproject | fedora | 35 | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
fedoraproject | fedora | 36 | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* |
fedoraproject | fedora | 37 | cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* |
siemens | sinec_ins | 1.0 | cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* |
siemens | sinec_ins | 1.0 | cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* |
siemens | sinec_ins | 1.0 | cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:* |
cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
hackerone.com/reports/1501679
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ICG6CSIB3GUWH5DUSQEVX53MOJW7LYK/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCNN3YG2BCLS4ZEKJ3CLSUT6AS7AXTH3/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMQK5L5SBYD47QQZ67LEMHNQ662GH3OY/
nodejs.org/en/blog/vulnerability/july-2022-security-releases/
www.debian.org/security/2023/dsa-5326