CVE-2021-22959CWE-444

The parser in accepts requests with a space (SP) right after the header name before the colon

published November 15, 2021

CVSS
—
EPSS
3%
Percentile
87.9
In the wild
Unconfirmed
What it is

The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03156 · 87.9th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2021-11-15T14:45Z
EPSS history
Timeline
  • 15 NOV 14:45Z
    The parser in accepts requests with a space (SP) right after the header name before the colon
    cvelistv5