CVE-2021-22960CWE-444

The parse function in llhttp < 2.1.4 and < 6.0.6

published November 3, 2021

CVSS
—
EPSS
2%
Percentile
84.4
In the wild
Unconfirmed
What it is

The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02472 · 84.4th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2021-11-03T19:22Z
EPSS history
Timeline
  • 03 NOV 19:22Z
    The parse function in llhttp < 2.1.4 and < 6.0.6
    cvelistv5