Description
nghttp2-s nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker-s favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
CVSS 5.4EPSS 0.263%Risque 0.55
Voir la source- Publication
- 2026-06-28 02:16:32
- Versions concernées
- <1.69.0
- Type
- Bibliothèque
- Vecteur
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N