EUVD-2026-109820

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

CVE-2026-114216

The mtrudel bandit web framework (versions 1.12.4 before 1.14.0 ) is vulnerable to an HTTP Request Smuggling attack due to an inconsistent interpretation of HTTP/1.1 chunked bodies in lib/bandit/http1/socket.ex. The chunked body reader fails to validate the chunk-ext grammar against RFC 9112 , al...

CVE-2026-114216 Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

Zyxel NAS Firmware 5.21- Remote Code Execution

Multiple Zyxel network-attached storage NAS devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. Zyxel NAS devices achieve authentication by using th...

Cisco Adaptive Security Appliance (ASA)/Firepower Threat Defense (FTD) - Local File Inclusion

Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software is vulnerable to local file inclusion due to directory traversal attacks that can read sensitive files on a targeted system because of a lack of proper input validation of URLs in HTTP requests processe...

PT-2026-123303

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackney http connect in benoitc hackney allows HTTP Request Splitting via the value a proxy auth fun callback returns. After a 407 response from an HTTP CONNECT proxy, hackney http...

PT-2026-123307

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

BenoitC Hackney input validation error vulnerability

In versions 2.0.0 through 4.9.0 of benoitc hackney, there is an input validation error vulnerability. This vulnerability stems from improper handling of CRLF sequences in the return value of the proxyauthfun callback. After a HTTP CONNECT proxy returns a 407 response, this value is written to the...

nodejs-http-transfer-encoding-smuggling-poc

nodejs-http-transfer-encoding-smuggling-poc PoC of HTTP Request Smuggling in nodejs CVE-2020-8287 src/index.js header: 'Host', '127.0.0.1', 'Transfer-Encoding', 'chunked', 'Transfer-Encoding', 'eee' , body: 'A' header: 'Host', '127.0.0.1' , body: '' data: 'HTTP/1.1 200 OK\r\n' + 'Date: Tue, 05 Ja...

Twisted: HTTP Request Smuggling In Twisted.web Via A Bare CR Or LF In A Header Value

Summary An incomplete header-value validation CWE-444 in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. "twisted.web.http.HTTPChannel.headerReceived" rejects a NUL byte in a header value but not a bare CR or LF, even...

CVE-2026-115214

The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator...

EUVD-2026-109352

The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator...

Citrix NetScaler ADC and Gateway 14.1 HTTP Request Smuggling

Citrix NetScaler ADC and Gateway versions before vendor-fixed builds contain an HTTP request smuggling vulnerability. The supplied offline Python checker assesses operator-reported build and configuration evidence without accessing appliances...

PT-2026-122950

The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability that could allow HTTP request smuggling (CVE-2026-2332).

Summary IBM Storage Protect Server uses the Eclipse Jetty HTTP library in certain components. A vulnerability in Jetty's HTTP/1.1 chunked transfer encoding parser could allow HTTP request smuggling through specially crafted chunk extensions. Due to improper handling of malformed quoted strings...

Citrix NetScaler ADC and Gateway HTTP Request Smuggling

Citrix NetScaler ADC and Gateway versions before the vendor-reported fixed builds contain an HTTP request smuggling vulnerability when HTTP configuration is enabled...

Exploit for HTTP Request Smuggling in Citrix Netscaler_Application_Delivery_Controller

netscaler-cve-2026-88773-check Standa...

CVE-2026-115877

A flaw was found in Twisted. The HTTP server component improperly accepts bare carriage return or line feed characters within header values instead of enforcing strict line endings. A remote attacker can exploit this framing disagreement against an upstream proxy to conduct HTTP request smuggling...

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

Summary An incomplete header-value validation CWE-444 in the Twisted HTTP server lets a bare carriage return or line feed in a header value hide a following header from the parser. twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in a header value but not a bare CR or LF, even thoug...

HTTP Request Smuggling

Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to HTTP Request Smuggling via the headerReceived function in src/twisted/web/http.py, which fails to reject bare CR \r and LF \n characters in HTTP...