HTTP Request Smuggling (CWE-444)
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Updated
About CWE-444
MITRE lists these common consequences: Unexpected State, Hide Activities, Bypass Protection Mechanism, affecting integrity, non-repudiation, access control.
- MITRE name
- Inconsistent Interpretation of HTTP Requests
- Abstraction
- Base: abstract, but detailed enough to infer detection and prevention methods
- Status
- Incomplete
Also Known As
- HTTP Request Smuggling
- HTTP Response Smuggling
- HTTP Smuggling
Mitigations
- Use a web server that employs a strict HTTP parsing procedure, such as Apache.
- Use only SSL communication.
- Terminate the client session after each request.
- Turn all pages to non-cacheable.
Detection
MITRE lists these detection methods: Automated Static Analysis.
CWE-444 in the KEV Catalog
as of 2026-11-12- 5 CISA KEV entries name HTTP Request Smuggling (CWE-444) in their CVE record, tied for 49th among the 194 weaknesses named in the catalog.
- CISA added 0 CWE-444 entries to the KEV catalog in 2024, 2 in 2025, and 1 so far in 2026.
- Qlik has the most CWE-444 entries in the CISA KEV catalog (2), followed by Kludex (1), Oracle (1), and SAP (1).
Related Attack Patterns
2 CAPEC patternsCAPEC-33HTTP Request SmugglingDetailed · Severity High · Likelihood Medium
Loading…
CAPEC-273HTTP Response SmugglingDetailed · Severity High · Likelihood Medium
Loading…
CWE-444 Vulnerabilities
6 CVEs| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-48710KEV Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks | Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks | Kludex | 6.5 | 70.3% | KEV | 2026-05-26 |
| CVE-2025-61884KEV Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability | Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability | Oracle Corporation | 7.5 | 95.9% | KEV | 2025-10-12 |
| CVE-2023-48365KEV Qlik Sense HTTP Tunneling Vulnerability | Qlik Sense HTTP Tunneling Vulnerability | - | 9.6 | 47.7% | KEV | 2023-11-15 |
| CVE-2023-41265KEV Qlik Sense HTTP Tunneling Vulnerability | Qlik Sense HTTP Tunneling Vulnerability | - | 9.6 | 88.2% | KEV | 2023-08-29 |
| CVE-2022-22536KEV SAP Multiple Products HTTP Request Smuggling Vulnerability | SAP Multiple Products HTTP Request Smuggling Vulnerability | SAP SE | 9.8 | 97.9% | KEV | 2022-02-09 |
| CVE-2026-88773 HTTP Request Smuggling | HTTP Request Smuggling | Citrix NetScaler | 9.3 | 3.1% | 2026-09-27 |
Frequently Asked Questions
What is CWE-444?→
CWE-444 (Inconsistent Interpretation of HTTP Requests) is a MITRE CWE entry. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
How many exploited vulnerabilities are classified as CWE-444?→
This database lists 6 CVE records mapped to CWE-444 by their CVE Numbering Authority. 5 of them are in the CISA Known Exploited Vulnerabilities catalog, and CISA links 3 to known ransomware campaigns. Examples include CVE-2026-48710, CVE-2025-61884, CVE-2023-48365.
Weakness description, consequences, and mitigations from the CWE List, © The MITRE Corporation, used under the CWE Terms of Use. CWE mappings come from each CVE record's CNA. Exploited-in-the-wild data from the CISA KEV catalog (CC0). This site is not affiliated with or endorsed by MITRE or CISA. Attack patterns from CAPEC 3.9, © The MITRE Corporation, used under the CAPEC Terms of Use.