CVE-2005-2089

The record

Microsoft IIS 5.0 and 6.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes IIS to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

Affected packages

Related vulnerabilities

• CVE-2026-18540 undici's retry interceptor can append the body of a ranged retry response to bytes… CWE-444
• CVE-2026-48932 A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based… CWE-444
• CVE-2026-63385 Libevent is an event notification library. CWE-444
• CVE-2026-63379 Libevent is an event notification library. CWE-444
• CVE-2026-63382 Libevent is an event notification library. CWE-444
• CVE-2026-71554 h2 is a pure-Python implementation of a HTTP/2 protocol stack. CWE-444
• CVE-2026-58044 A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based… CWE-444
• CVE-2026-69243 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-444