Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
UndertowEndpoint or Undertow configuration is using HttpHeaderFilterStrategy instead of UndertowHeaderFilterStrategy. This allows unvalidated or internal headers (such as 'websocket.*' directives) to be propagated into the Camel Exchange, potentially leading to message routing hijacking or improper header handling.
`headerComplete` callback in HTTP parser does not check `inChunkedHeaders()` before appending header fields. This can cause HTTP/1.1 chunked trailer fields to be improperly merged into request headers, enabling HTTP header injection and proxy control bypasses (CVE-2026-73495).
HTTP protocol version string length is checked with an impossible condition (len > 8 for an 8-character version string like "HTTP/1.0"). This causes HTTP/1.0 detection to always fail and may lead to HTTP request smuggling.
Request header processing assigns the Host header value without verifying whether a Host header was already received. Unvalidated duplicate Host headers can enable HTTP request smuggling or host spoofing attacks.
Prematurely setting connection upgrade state or conditioning payload reader creation on upgrade status allows unread request body bytes to linger in the buffer, causing HTTP request smuggling (CWE-444).
Incomplete validation of HTTP/2 header or pseudo-header values allows space and control characters (0x01-0x1F, 0x20, 0x7F) through to HTTP/1.1 request lines or headers, potentially enabling HTTP request smuggling or response splitting (CWE-444, CWE-113).
HTTP chunked trailers are parsed directly into request headers via `evhttp_parse_headers_`, which can cause trailer headers to merge into request headers and allow HTTP request smuggling or header spoofing. Trailers should be parsed into a separate temporary list and discarded.
Using `Integer.parse/1` or `Integer.parse/2` to parse `Content-Length` or other HTTP length headers can leave the application vulnerable to HTTP Request/Response Smuggling. Elixir's `Integer.parse` accepts an optional `+` or `-` prefix, which violates RFC 7230's strict digital-only format for lengths. A proxy may parse this strictly while this application pa
Envoy's HTTP/3 QUIC stream implementation fails to validate the `content-length` header for headers-only streams. This misses a check to ensure that streams marked as complete at the transport layer have a `content-length` consistent with having no body. This can lead to HTTP request smuggling or desync when proxying to HTTP/1. Ensure `updateReceivedContentB
String parsing using `replace` assigning extracted keys to an object without checking for duplicate keys. This may allow parameter smuggling or injection if the parser receives duplicate keys (e.g., in HTTP headers). Validate that the key does not already exist before assignment.
Extracting HTTP request headers such as 'content-length' using a function that only returns the first occurrence (like `List.keyfind`) ignores duplicates. This violates RFC 9112 §6.3 and can permit HTTP Request Smuggling. Instead of fetching the first match, filter all matching headers and reject the request if duplicates or conflicts are found.
WEBrick indiscriminately appends HTTP chunked trailers to the raw request headers buffer and parses them in conjunction with the primary request headers using HTTPUtils::parse_header. This bypasses the trailer/header boundary and allows trailers to overwrite authoritative headers like Content-Length or Host, enabling HTTP Request Smuggling. The patch cleanly
The HTTP decoder allows standalone Line Feed (LF) characters as line terminators for chunk delimiters and header lines, skipping arbitrary bytes. This violates HTTP/1.1 RFC requirements (which mandate CRLF) and enables HTTP Request Smuggling when fronted by a proxy network that handles LF properly. Ensure that chunks and header parsers strictly enforce the p
The HttpPayloadParser instantiation is missing the `headers_parser` argument. In pure-Python versions of aiohttp prior to 3.12.14, trailer sections in chunked requests were discarded without structural validation, leading to HTTP request smuggling (CVE-2025-53643) as front-end proxies might interpret the malformed payload differently. Ensure a capability to
An *http.Request body read/forward is gated only on `ContentLength > 0`, without also accepting chunked Transfer-Encoding. RFC 7230 specifies that Content-Length is ignored when Transfer-Encoding: chunked is set, and Go's net/http reports `r.ContentLength == -1` for chunked requests. A client can therefore smuggle a body past this gate by sending a chunked r
Manually setting the `Content-Length` header on an XMLHttpRequest is unsafe and forbidden by the W3C specification. Calculating the body length manually (e.g., using string `.length` which calculates character count, not byte count) results in an incorrect header value if the payload contains multi-byte characters. This manipulation enables HTTP Request Smug
