CVE-2026-40562

Katalog CVE

CVSS 7.5 · High EPSS 0,50%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada kazeburo gazelle. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Gazelle incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.

Rincian

Terbit di NVD

6 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.metacpan.org/patches/G/Gazelle/0.49/CVE-2026-40562-r1.patch patch
• https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/05/06/7 mailing list · advisory pihak ketiga
• https://metacpan.org/release/KAZEBURO/Gazelle-0.50/changes release notes