| Package | Affected versions | Patched versions |
|---|---|---|
| llhttp | ≥ 3.0.0, < 6.0.6< 2.1.4 | 6.0.62.1.4 |
| graalvm | = 20.3.4= 21.3.0 |
The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free