HTTP Request Smuggling due to mishandled Transfer-Encoding parsing

Summary

ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks.

Details

The ServiceTalk HTTP/1.x HttpObjectDecoder.readHeaders does not validate Transfer-Encoding against the RFC 9112 section 6.1 rules: Transfer-Encoding on a non-HTTP/1.1 message is silently accepted, a TE list where chunked is not the final coding is silently treated as chunked-encoded regardless of role, and a message with both Transfer-Encoding and Content-Length is processed per Transfer-Encoding alone without closing the connection afterward as section 6.1 requires.

Impact

HTTP Request Smuggling: Attacker injects arbitrary HTTP requests.