CVE-2026-78660
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Oct 8, 2026
CISA due date
—
The record
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112212 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before… CWE-444
- CVE-2026-111750 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-444
- CVE-2026-88829 A flaw was found in BusyBox httpd's reverse proxy feature. CWE-444
- CVE-2026-94439 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns… CWE-444
- CVE-2026-56866 When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it… CWE-444
- CVE-2026-85078 Sanic is an opensource python web server/framework. CWE-444
- CVE-2026-81356 Inconsistent interpretation of http requests ('http request/response smuggling') in… CWE-444
- CVE-2026-19203 A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that… CWE-444