| Package | Affected versions | Patched versions |
|---|---|---|
| llhttp | ≥ 3.0.0, < 6.0.6< 2.1.4 | 6.0.62.1.4 |
| graalvm | = 20.3.4= 21.3.0 |
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free