The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

What CVEs are caused by CWE-444?

230 recorded CVEs are attributed to CWE-444, including CVE-2023-48365, CVE-2022-22536, CVE-2025-1867. 2 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

How do you prevent CWE-444?

Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].

How is CWE-444 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

What are the consequences of CWE-444?

Exploiting CWE-444 can lead to: Unexpected State, Hide Activities, Bypass Protection Mechanism.

Is CWE-444 actively exploited?

Yes. 2 CWE-444 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 230 recorded CVEs.

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (HTTP Request Smuggling)

RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

In the following example, a malformed HTTP request is sent to a website that includes a proxy server and a web server with the intent of poisoning the cache to associate one webpage with another malicious webpage.

Safe example

java

protected void processRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

In the following example, a malformed HTTP request is sent to a website that includes a web server with a firewall with the intent of bypassing the web server firewall to smuggle malicious code into the system.

Attack input

plaintext

POST /page.asp HTTP/1.1

The interpretation of HTTP responses can be manipulated if response headers include a space between the header name and colon, or if HTTP 1.1 headers are sent through a proxy configured for HTTP 1.0, allowing for HTTP response smuggling. This can be exploited in web browsers and other applications when used in combination with various proxy servers. For instance, the HTTP response interpreted by the front-end/client HTTP agent/entity - in this case the web browser - can interpret a single response from an adversary-compromised web server as being two responses from two different web sites. In the Example below, notice the extra space after the Content-Length and Set-Cookie headers.

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Terminology & mappings

Alternate terms

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-444

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Parent

Terminology & mappings

Alternate terms

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-444