Security Research

CVE-2024-40725 Apache HTTPD HTTP request smuggling: Content-Length parsing inconsistency

Thinking 2024-07-15 5 min read Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
Dark dossier of HTTP request smuggling flow and protocol boundary mismatch

Apache HTTPD processes Content-Length headers with special characters differently from the proxy/backend, letting an attacker craft a special request to perform HTTP request smuggling.

Unlock to view this content.