CWE-444 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-444 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 실제 악용이 확인됨CVE-2022-22536SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Con…97.9%심각10.0● 랜섬웨어 캠페인에 사용됨CVE-2025-61884Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).…95.9%높음7.5● 랜섬웨어 캠페인에 사용됨CVE-2023-41265An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May …88.2%심각9.9● 실제 악용이 확인됨CVE-2026-48710Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request h…70.3%보통6.5● 랜섬웨어 캠페인에 사용됨CVE-2023-48365Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code exec…47.7%심각9.9CVE-2026-61642Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of …4.7%높음7.7CVE-2026-93574A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulne…0.9%보통6.5CVE-2026-70188Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core all…0.8%심각9.1
전체 목록
74건
CVE-2026-88092Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an una…0.8%심각9.4
CVE-2026-93569A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to …0.7%높음8.2
CVE-2026-37604pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/fra…0.7%심각9.8
CVE-2026-114216Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1…0.6%보통6.3
CVE-2026-93573A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-…0.6%보통6.5
CVE-2026-82672Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint …0.5%보통6.3
CVE-2026-69217Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts…0.5%높음8.7
CVE-2026-63718Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerabil…0.5%높음7.5
CVE-2026-73548Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.…0.5%높음7.5
CVE-2026-118264Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel fr…0.4%심각9.1
CVE-2026-105298Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority …0.4%보통6.3
CVE-2026-55614uhttpd is a small HTTP server. In unpatched repository snapshots, `client_parse_header()` in `client.c` lowerc…0.4%보통6.9
CVE-2026-55613uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desync…0.4%보통6.9
CVE-2026-69205Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a ca…0.4%높음8.7
CVE-2026-73494blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and…0.4%높음7.4
CVE-2023-54397Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Lengt…0.4%심각9.0
CVE-2026-103995Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in mi…0.4%낮음2.0
CVE-2024-14029Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no mess…0.4%심각9.0
CVE-2025-31699Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on …0.3%심각9.1
CVE-2026-88773Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetSc…0.4%심각9.3
CVE-2026-88008Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik…0.3%높음7.0
CVE-2026-69204Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject …0.3%심각9.2
CVE-2026-105299Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through …0.3%높음8.7
CVE-2026-100724http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains)…0.3%보통6.3
CVE-2025-55702When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Tr…0.3%높음7.0
CVE-2026-81356Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows …0.3%높음8.2
CVE-2026-93003The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the e…0.3%보통6.9
CVE-2026-94194Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint …0.3%보통6.3
CVE-2026-111816Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, beca…0.3%심각9.2
CVE-2026-57488pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in u…0.3%높음7.1
CVE-2026-88829A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests ma…0.3%높음7.2
CVE-2026-94439When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking th…0.3%높음7.5
CVE-2026-85078Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body han…0.3%보통6.5
CVE-2026-56866When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly…0.3%높음7.5
CVE-2026-111750AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Pyth…0.3%보통6.3
CVE-2026-86350Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tom…0.3%심각9.1
CVE-2026-55612uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` cons…0.3%낮음3.7
CVE-2026-78660Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as…0.3%높음7.5
CVE-2026-19203A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an inter…0.3%높음8.3
CVE-2026-79713The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in…0.3%보통6.5
CVE-2026-88009Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts …0.3%높음8.8
CVE-2026-115877Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, tw…0.3%보통5.4
CVE-2026-15634IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to…0.3%보통6.5
CVE-2026-15396IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to…0.3%보통6.5
CVE-2026-89044Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly vali…0.2%보통6.9
CVE-2026-77756Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomca…0.3%낮음3.7
CVE-2026-69216Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the…0.2%보통5.4
CVE-2026-91920A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked tran…0.2%보통6.5
CVE-2026-103399A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue an…0.2%보통5.3
CVE-2026-100666Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versio…0.2%보통6.9
CVE-2026-100659Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforc…0.2%보통6.9
CVE-2026-111809Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encodin…0.2%보통6.9
CVE-2026-11710IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper ha…0.2%보통6.5
CVE-2026-18540undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an e…0.2%낮음3.7
CVE-2026-86146Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser …0.2%미평가
CVE-2026-115823Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on k…0.2%미평가
CVE-2026-112212GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.…0.2%높음7.5
CVE-2026-11722IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smug…0.2%보통4.8
CVE-2026-11548IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smug…0.2%보통4.8
CVE-2026-116127Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response …0.2%미평가
CVE-2026-10841IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling.0.2%보통4.2
CVE-2026-77802In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling…0.1%보통6.3
CVE-2026-77803In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desy…0.1%낮음3.6
CVE-2018-3908An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings …높음7.5
CVE-2018-3909An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings …높음8.6
CVE-2018-3907An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings …심각10.0
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.