Veille CVE

‹ Retour à la liste

CVE-2026-66752

5.4 Moyenne

Publiée le 28/07/2026 à 18:20 · Modifiée le 30/07/2026 à 22:03 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard Content-Length. Attackers can exploit the discrepancy between tiny_http's improper Transfer-Encoding parsing and a correctly-implemented front-end proxy to produce two distinct interpretations of a single byte stream, enabling request smuggling, and can additionally send non-chunked bodies with non-chunked Transfer-Encoding values to cause failed body reads that tie up connections and consume worker threads without signaling errors to clients.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
4.0 6.3 Moyenne disclosure@vulncheck.com CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
3.1 5.4 Moyenne disclosure@vulncheck.com CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Faiblesses (CWE)

Références

Ailleurs