Detecting HTTP Request Smuggling with Qualys WAS | Qualys
Summary: HTTP Request Smuggling lets an attacker hide a second request inside the body of a first by exploiting the HTTP specification's two ways to signal a request's end: the Content-Length header or the Transfer-Encoding: chunked header. Qualys Web Application Scanning released QID 150300 as an initial detection, testing only the CL:TE method because other methods carry false-positive risk, and it confirms the vulnerability when a second crafted request returns a 403, 405, or 501 response.
What you should know: The flaw lives in the chain of servers between client and application, so remediation involves network architecture and server configuration settings that a typical application developer may not be able to fix. Qualys marks QID 150300 experimental because it tests only one of several known methods, yet a confirmed finding is very likely a true positive.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026