CERT24HSEC-2026-0013 — HTTP Request Smuggling in warpLoading data…
CERT24Threat Observatory
Period

HSEC-2026-0013 — HTTP Request Smuggling in warp

warp's HTTP/1.x request parser accepted request framing that RFC 9112 requires recipients to refuse. This could allow a front-end proxy and warp to interpret the same request differently, smuggling a request past the proxy. warp 3.4.17 fixes six defects. warp's HTTP/2 support delegates parsing to the http2 package and is not affected.

← Back to intelligence

HSEC-2026-0013 — HTTP Request Smuggling in warp

warp's HTTP/1.x request parser accepted request framing that RFC 9112 requires recipients to refuse. This could allow a front-end proxy and warp to interpret the same request differently, smuggling a request past the proxy. warp 3.4.17 fixes six defects. warp's HTTP/2 support delegates parsing to the http2 package and is not affected.