Description

ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk version 0.42.65.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T21:17:39.587Z",
  "pubdate": "2026-08-12T21:17:39.587Z",
  "executiveSummary": "ServiceTalk HTTP/1.x contains a vulnerability involving the incorrect handling of malformed Transfer-Encoding headers.\nThis flaw can be leveraged to conduct HTTP request smuggling attacks against affected systems.\nThe vulnerability specifically impacts the ServiceTalk product prior to version 0.42.65.\nSuccessful exploitation allows attackers to bypass security controls, poison web caches, or hijack downstream requests processed by frontend proxies and backend servers.\nThe risk implication is severe, as it compromises the integrity and confidentiality of HTTP traffic passing through the affected infrastructure.\nAn attacker must be capable of crafting and sending malformed HTTP requests over the network to exploit this parsing discrepancy.",
  "technicalDetails": "The root cause of the vulnerability resides in the HTTP/1.x protocol parser within ServiceTalk, specifically in how it processes the Transfer-Encoding header when presented with malformed or conflicting input.\nHTTP request smuggling occurs when discrepancies exist between a frontend proxy and a backend server (or within the parser itself) regarding the determination of the message body length, typically involving both Content-Length and Transfer-Encoding headers.\nWhen ServiceTalk incorrectly handles a malformed Transfer-Encoding header, it may misinterpret the boundaries of an incoming HTTP request.\nAn attacker initiates the attack flow by transmitting a specially crafted HTTP/1.x request containing anomalous or malformed Transfer-Encoding header values.\nUpon receiving this payload, the vulnerable ServiceTalk component parses the request boundaries incorrectly, leading to a state where the parser desynchronizes from the actual data stream.\nThe remaining bytes of the smuggled request are treated by the parser as the prefix of the subsequent HTTP request, effectively blending requests together.\nThis behavior allows the attacker to prepend arbitrary HTTP requests that are processed by the server as if they originated from a trusted client or session.\nThe vulnerable component is the ServiceTalk HTTP/1.x parsing engine in versions prior to 0.42.65.\nExploitation requires network exposure to the HTTP/1.x service, and does not inherently require authentication or high-level privileges.\nPost-exploitation impact includes unauthorized data access, session hijacking, credential theft via request hijacking, and bypass of web application firewalls."
}