地图 / HTTP 请求走私

HTTP 请求走私

HTTP Request Smuggling · 注入与走私

注入与走私 / HTTP 请求走私

68公开报告

—CWE 编号

0已标注发现方式

68关联报告

发现方式分布

暂无发现方式标注。

关联报告

Bypass for #488147 enables stored XSS on https://paypal.com/signin againPayPal · 2019-08-07 · 中危 · $20,000 · 2,687 票 Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookiesSlack · 2020-03-12 · 高危 · 870 票 Stored XSS on https://paypal.com/signin via cache poisoningPayPal · 2019-08-07 · 中危 · $18,900 · 685 票 Request smuggling on admin-official.line.me could lead to account takeoverLY Corporation · 2020-05-19 · 中危 · 565 票 Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.comEternal · 2020-07-09 · 高危 · 559 票 Password theft login.newrelic.com via Request SmugglingNew Relic · — · 未评级 · $3,000 · 490 票 HTTP Request Smuggling via HTTP/2Basecamp · 2021-08-27 · 高危 · $7,500 · 300 票 HTTP request SmugglingHelium · 2020-07-02 · 中危 · 300 票 HTTP Request Smuggling on https://labs.data.govGSA Bounty · 2020-05-13 · 中危 · $750 · 160 票 HTTP Request Smuggling at app.workbox.dkVisma Public · — · 未评级 · $500 · 139 票 HTTP Request Smuggling due to CR-to-Hyphen conversionNode.js · 2020-10-17 · 中危 · 134 票 HTTP Request Smuggling on vpn.lob.comLob · — · 未评级 · $500 · 123 票 Improper HTTP header block termination in llhttpNode.js · 2025-06-13 · 低危 · 122 票 HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() functionCloudflare Public Bug Bounty · 2022-05-16 · 高危 · $6,000 · 116 票 HTTP request smuggling using malformed Transfer-Encoding headerNode.js · 2020-03-07 · 高危 · 105 票 Possibility of Request smuggling attackInternet Bug Bounty · 2023-12-22 · 中危 · $4,660 · 93 票 Pause-based desync in Apache HTTPDInternet Bug Bounty · 2022-08-25 · 中危 · $4,000 · 74 票 HTTP SMUGGLING EXPOSED HMAC/DOSMagic · 2020-03-24 · 低危 · 74 票 CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)Internet Bug Bounty · 2024-01-29 · 中危 · $4,660 · 57 票 Potential HTTP Request Smuggling in ruby webrickRuby · 2020-10-29 · 低危 · 53 票 Request Smuggling in Apache Tomcat (Important, CVE-2023-45648)Internet Bug Bounty · 2024-02-07 · 中危 · $4,660 · 51 票 HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parserNode.js · 2026-07-31 · 低危 · 49 票 HTTP request smuggling with Origin Rules using newlines in the host_header action parameterCloudflare Public Bug Bounty · 2022-06-27 · 高危 · $3,100 · 46 票 HTTP Request SmugglingU.S. Dept Of Defense · 2021-04-20 · 中危 · 40 票 Potential HTTP Request Smuggling in nodejsNode.js · 2021-01-07 · 低危 · $250 · 34 票 Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status LineNode.js · 2026-07-01 · 低危 · 30 票 HTTP/1.1 Response Desynchronization via conflicting CL/TE headers in Proxy CONNECTcurl · 2026-03-25 · 低危 · 30 票 HTTP Request Smuggling on api.flocktory.com Leads to XSS on Customer SitesQIWI · — · 未评级 · 29 票 HTTP request smuggling on Basecamp 2 allows web cache poisoningBasecamp · 2020-10-28 · 高危 · 28 票 Host Header InjectionKartpay · 2021-05-10 · 低危 · 27 票 Unauthenticated request smuggling on launchpad.37signals.comBasecamp · 2020-10-28 · 高危 · 27 票 HTTP/1.1 response framing violation and unsafe connection reuse when transfer decoding is disabledcurl · 2026-09-19 · 低危 · 26 票 Request smuggling on ████████U.S. Dept Of Defense · 2019-10-08 · 中危 · 25 票 http request smuggling in pscp.tv and periscope.tvX / xAI · 2020-09-10 · 中危 · $560 · 24 票 HTTP Request Smuggling Vulnerability Analysis - cURL Security Reportcurl · 2025-07-13 · 低危 · 23 票 [spectacles.com] Bypassing quantity limit in ordersSnapchat · 2017-08-12 · 低危 · $250 · 22 票 Incomplete Suppression of Transfer-Encoding: chunked Header in HTTP/2 After Redirect From HTTP/1.1curl · 2026-06-15 · 低危 · 21 票 Multiple HTTP Smuggling reportsInternet Bug Bounty · 2019-11-12 · 高危 · 20 票 Duplicate chunked Transfer-Encoding lets a malicious origin smuggle a response across reused HTTP proxy connectionscurl · 2026-06-13 · 低危 · 18 票 HTTP Request Smuggling via Content Length ObfuscationNode.js · 2024-05-03 · 低危 · 18 票 [demo.stripo.email] HTTP request SmugglingStripo Inc · 2024-02-15 · 低危 · 18 票 HTTP Request Smuggling due to accepting space before colonNode.js · 2021-10-20 · 低危 · $250 · 18 票 http request smuggling in twitter.comX / xAI · 2020-11-18 · 中危 · 17 票 HTTP/1.1 connection reuse returns unsolicited server data as the next request's response (regression in 8.22.0)curl · 2026-10-15 · 低危 · 16 票 HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP ParserNode.js · 2026-08-28 · 低危 · 16 票 HTTP Request Smuggling via Empty headers separated by CRInternet Bug Bounty · 2023-08-28 · 低危 · $1,800 · 16 票 HTTP Request Smuggling on https://consumer.acronis.comAcronis · 2021-11-16 · 低危 · 16 票 HTTP Request Smuggling Due to Incorrect Parsing of Header FieldsInternet Bug Bounty · 2023-04-09 · 低危 · $1,800 · 15 票 CVE-2022-32213 - HTTP Request Smuggling Due to Flawed Parsing of Transfer-EncodingInternet Bug Bounty · 2022-07-22 · 低危 · $1,800 · 13 票 HTTP Request Smuggling on https://promosandbox.acronis.comAcronis · 2021-11-16 · 低危 · 12 票 HTTP Request SmugglingBrave Software · 2020-06-04 · 中危 · 12 票 CVE-2022-32214 - HTTP Request Smuggling Due To Improper Delimiting of Header FieldsInternet Bug Bounty · 2022-07-22 · 低危 · $1,800 · 11 票 Hackerone1RATELIMITED · 2018-12-21 · 中危 · 11 票 Apache HTTP Request Parsing Whitespace DefectsInternet Bug Bounty · 2017-07-11 · 低危 · 11 票 HTTP Request SmugglingJamieWeb · 2020-03-09 · 低危 · 10 票 HTTP Request Smuggling and SSRF via CRLF Injection in Curl_add_custom_headerscurl · 2026-01-02 · 中危 · 9 票 HTTP Request Smuggling Due To Improper Delimiting of Header FieldsNode.js · 2022-07-07 · 低危 · 9 票 HTTP Request Smuggling via Empty headers separated by CRNode.js · 2023-06-20 · 低危 · 8 票 Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDNNode.js third-party modules · 2020-12-10 · 低危 · 8 票 HTTP Request Smuggling Due to Flawed Parsing of Transfer-EncodingNode.js · 2022-07-07 · 低危 · 7 票 HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-EncodingNode.js · 2022-07-07 · 低危 · 7 票 HTTP Request Smuggling due to ignoring chunk extensionsNode.js · 2021-11-02 · 低危 · $250 · 7 票 HTTP Request Smuggling Due to Incorrect Parsing of Header FieldsNode.js · 2022-10-26 · 低危 · 6 票 HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-Encoding (improper fix for CVE-2022-32215)Node.js · 2022-10-26 · 低危 · 6 票 CVE-2022-32215 - HTTP Request Smuggling Due to Incorrect Parsing of Multi-line Transfer-EncodingInternet Bug Bounty · 2022-07-22 · 低危 · $1,800 · 6 票 CVE-2022-32213 bypass via obs-fold mechanicNode.js · 2022-10-26 · 低危 · 5 票 HTTP Header Injection/HTTP_Response_SplittingBlockchain · 2017-03-23 · 低危 · 4 票 Gratipay Website CSP "script-scr" includes "unsafe-inline"Gratipay · 2017-05-25 · 低危 · 1 票