EUVD-2026-83386

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls ...

EUVD-2026-83385

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

EUVD-2026-83290

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

CVE-2026-11722

CVE-2026-11722 is an HTTP request smuggling vulnerability (CWE-444) affecting IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8). The vulnerability requires no authentication and has high attack complexity, with lo...

EUVD-2026-83287

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers...

CVE-2026-11710

IBM WebSphere Application Server 8.5 (versions 8.5.5.0 through 8.5.5.30) is vulnerable to HTTP request smuggling caused by improper handling of Content-Length headers (CWE-444). The flaw allows an attacker to send crafted requests that are interpreted differently by the server versus downstream c...

EUVD-2026-83281

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability...

CVE-2026-11548

CVE-2026-11548 is an HTTP request smuggling vulnerability (CWE-444) affecting IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8). The CVSS 3.1 score is 4.8 (Medium) , with a network attack vector, high complexity, ...

CVE-2026-10841

IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling...

CVE-2026-10841

IBM WebSphere Application Server versions 8.5 (through 8.5.5.30), 9.0 (through 9.0.5.28), and Liberty (17.0.0.3 through 26.0.0.8) are vulnerable to HTTP request smuggling (CWE-444: Inconsistent Interpretation of HTTP Requests). The vulnerability allows an authenticated attacker with low privilege...

EUVD-2026-83030

IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling...

CVE-2026-10841 Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling...

CVE-2026-93566

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

EUVD-2026-82935

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

CVE-2026-93566 Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

http-request-smuggler

HTTP Request Smuggler 이 Burp Suite 확장 프로그램은 PortSwigger 연구원 James Kettle이 개발한 고급 desynchronization 기술을 사용하여 HTTP Request Smuggling 취약점을 자동으로 탐지하고 악용합니다. HTTP/1.1 및 HTTP/2-downgrade desync 취약점, 클라이언트 측 desync, 연결 상태 공격에 대한 포괄적인 스캐닝을 지원합니다. 버전 3.0은 2025년에 출시되어 광범위한 desync 방어를 우회하고 훨씬 더 효과적으로 만드는 파서...

CVE-2024-40725-CVE-2024-40898

🚨경고🚨Apache 취약점 🚨경고🚨보안 권고: CVE-2024-40725 및 CVE-2024-40898🚨경고🚨 CVE-2024-40725 설명: CVE-2024-40725는 Apache HTTP Server 버전 2.4.0부터 2.4.61에서 발견된 높은 심각도의 취약점입니다. 이 취약점은 modproxy 모듈에 영향을 미칩니다. ProxyPass 지시어가 활성화되고 URL 재작성 규칙이 구성된 경우, 공격자는 이 취약점을 악용하여 HTTP 요청 스머글링 공격을 수행할 수 있습니다. 이러한 유형의 공격은 프록시와 백엔드 서버 ...

smuggler

root@kitploit: / | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler Инструмент для тестирования манипуляции HTTP-запросами HTTP Request Smuggling / Desync, написанный на Python 3 Благодарности Особая благодарность James Kettle за его исследования и методы...

CVE-2023-25690_lab

Apache 프록시를 통한 HTTP Request Smuggling 환경 설정 인프라...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by an HTTP request smuggling vulnerability

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by an HTTP request smuggling vulnerability CVE-2026-11710 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...