CVE-2025-55018

The record

An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header

Affected packages

Related vulnerabilities

• CVE-2026-112212 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before… CWE-444
• CVE-2026-111750 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-444
• CVE-2026-88829 A flaw was found in BusyBox httpd's reverse proxy feature. CWE-444
• CVE-2026-94439 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns… CWE-444
• CVE-2026-78660 Historically, we have been rather lax about malformed framing-related headers in our… CWE-444
• CVE-2026-56866 When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it… CWE-444
• CVE-2026-85078 Sanic is an opensource python web server/framework. CWE-444
• CVE-2026-81356 Inconsistent interpretation of http requests ('http request/response smuggling') in… CWE-444