Definition

MITRE’s description of CWE-444: The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Common consequences MITRE lists

  • Integrity, Non-Repudiation, Access Control: Unexpected State; Hide Activities; Bypass Protection Mechanism

Why it matters

Smuggled requests bypass front-end security controls, poison caches and can capture other users’ requests, including their cookies.

How to prevent it

  • Reject ambiguous framing at every hop, such as both Content-Length and Transfer-Encoding, duplicate lengths or malformed chunks.
  • Use HTTP/2 end to end where possible, and avoid downgrading requests to HTTP/1.1 between the proxy and the back end.
  • Keep proxies and servers patched and configured to normalize or reject non-compliant messages.
  • Test the deployed proxy chain with desynchronization payloads.

Guides on this site

Main subject · Guide

Keep HTTP request boundaries consistent across intermediaries

Trace framing disagreements, reject ambiguous requests and verify what reaches the origin with a real loopback proxy project.

Also covers this · Guide

Operate edge rules without hiding application defects

Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.

Practice

References

  1. CWE-444 in the MITRE CWE list (version 4.20)

List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.