CVE-2022-21826

Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down...

SA45476 - Client Side Desync Attack (Informational)

Last Modified Date Aug 24, 2026 12:35:08 AM...

CVE-2022-21826

creationtimestamp| type| source ---|---|--- 2022-09-30 20:36:26+00:00| seen| https://t.me/cibsecurity/50786...

CVE-2022-21826

Pulse Connect Secure (Pulse Secure) versions 9.115 and below are affected by a client-side HTTP request smuggling vulnerability. When handling a POST request, the application may ignore the Content-Length header and keep the POST body on the TCP/TLS socket, causing the body to prefix the next HTT...