On this page
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Weakness Summary
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
- Canonical source: MITRE CWE-444 (opens in a new tab)
- Published Atomicorp CVE observations: 10
- Distinct affected products in those observations: 9
- Active Atomicorp rules associated with this weakness: 31
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2022-22536 | SAP Memory Pipes (MPI) Desynchronization | content server | Detected by Atomicorp rules | 392301 |
| CVE-2025-14523 | libsoup: duplicate Host header handling, last value wins | libsoup | Protected by Atomicorp rules | 340364 |
| CVE-2026-93569 | Netty codec-http2: absolute-form Host mismatch translated to :authority | netty-codec-http2 | Protected by Atomicorp rules | 340364 |
| CVE-2025-61884 | Oracle E-Business Suite - Server-Side Request Forgery | configurator | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 341256 , 342259 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2017-15643 | Ikraus Anti Virus 2.16.7 - Remote Code Execution | ikarus antivirus | Protected by Atomicorp rules | 390727 , 392301 , 392648 |
| CVE-2026-59900 | Netty codec-http2: Host header not deduplicated in HTTP/2 to HTTP/1.x translation | netty-codec-http2 | Protected by Atomicorp rules | 340364 |
| CVE-2026-48710 | Starlette - Improper Validation of Unsafe Equivalence in Input | starlette | Protected by Atomicorp rules | 320009 |
| CVE-2026-55087 | Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope | etherpad | Protected by Atomicorp rules | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-115877 | Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value | twisted | Protected by Atomicorp rules | 340006 , 390719 |
| CVE-2026-71554 | h2 (Python HTTP/2): duplicate Host header forwarded, request smuggling | h2 | Protected by Atomicorp rules | 340364 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 320009 | Active | disruptive (deny) |
| 333140 | Active | disruptive (deny) |
| 333141 | Active | disruptive (deny) |
| 337109 | Active | disruptive (deny) |
| 337110 | Active | disruptive (deny) |
| 340006 | Active | disruptive (deny) |
| 340087 | Active | disruptive (deny) |
| 340095 | Active | disruptive (deny) |
| 340099 | Active | disruptive (deny) |
| 340147 | Active | disruptive (deny) |
| 340148 | Active | disruptive (deny) |
| 340162 | Active | disruptive (deny) |
| 340163 | Active | disruptive (deny) |
| 340165 | Active | disruptive (deny) |
| 340364 | Active | disruptive (deny) |
| 341099 | Active | disruptive (deny) |
| 341256 | Active | disruptive (deny) |
| 341266 | Active | disruptive (deny) |
| 342259 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 346755 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 350147 | Active | disruptive (deny) |
| 350148 | Active | disruptive (deny) |
| 390719 | Active | disruptive (deny) |
| 390722 | Active | disruptive (deny) |
| 390727 | Active | disruptive (deny) |
| 392301 | Active | disruptive (deny) |
| 392648 | Active | disruptive (deny) |
| 398021 | Active | disruptive (deny) |
| 398022 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:
CAPEC-273 (opens in a new tab) , CAPEC-33 (opens in a new tab)