HTTP Request Smuggling due to mishandled Transfer-Encoding parsing

Medium6.5CVE-2026-65370 · Published Aug 12, 2026

### Summary ServiceTalk HTTP/1.x incorrectly handles malformed `Transfer-Encoding` which could result in request smuggling attacks. ### Details The ServiceTalk HTTP/1.x `HttpObjectDecoder.readHeaders` does not validate `Transfer-Encoding` against the RFC 9112 section 6.1 rules: `Transfer-Encoding` on a non-HTTP/1.1 message is silently accepted, a `TE` list where `chunked` is not the final coding is silently treated as chunked-encoded regardless of role, and a message with both `Transfer-Encoding` and `Content-Length` is processed per `Transfer-Encoding` alone without closing the connection afterward as section 6.1 requires. ### Impact HTTP Request Smuggling: Attacker injects arbitrary HTTP requests.