Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/httpcomponents-core

              master @ c73e499
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

HTTP Request Smuggling: 4 prior fixes. Scrutinize any change in this area.

httpcore5-h2: most-fixed (4 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Request Smuggling: Inconsistent parsing of multiple Transfer-Encoding (TE) headers or tokens can allow attackers to bypass front-end proxy restrictions by causing desynchronization between the proxy and back-end server. Prior fixes only validated the first TE header occurrence.

HTTP Request Smuggling: Discrepancies between the HTTP/2 ':authority' pseudo-header and the standard 'Host' header can result in routing bypasses and request smuggling. Strict validation matching both values is required during stream processing.

HTTP Request Smuggling: Allowing invalid characters (such as uppercase pseudo-headers, control characters, or trailing whitespace) in HTTP/2 headers violates RFC 9113 and exposes the request converter to smuggling vectors when translated back to HTTP/1.1.