HTTP Request Smuggling
Critical · Protocol
OWASP Top 10:2025 (current)
A02:2025 — Security Misconfiguration
Historical Top 10:2021 (not current)
A05:2021 — kept for older reports; use 2025 above.
CWE
CWE-444
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-444 · OWASP A02:2025 · OWASP A05:2021
Definition
Front/back servers parse HTTP boundaries differently.
Root cause
Conflicting Content-Length and Transfer-Encoding.
Affected components
- Components in the “Protocol” class
- Application / API handlers
- Supporting libraries
Impact
Cache poisoning, auth bypass, request hijacking.
Severity
Critical · CVSS 9.8
Safe lab reproduction
PortSwigger request smuggling labs
Detection methodology
Differential response testing in authorized labs.
Evidence examples
- Lab reproduction notes: PortSwigger request smuggling labs
- Request/response excerpts (redacted)
- Detection signal: Differential response testing in authorized labs
Remediation
Normalize parsing; disable ambiguous TE; HTTP/2 end-to-end.
Secure coding examples
Use hardened reverse proxies with consistent parsing.
Related CYNARKS lessons & labs
Tools: burp
Primary 2025 class: A02:2025 — Security Misconfiguration
Practise related skills in Labs or deepen on Academy library.