Executive brief
Hiawatha is a lightweight web server and reverse proxy used to host websites and manage network traffic. A security flaw in how it handles web requests allows an attacker to interfere with the communication between the server and its users. This can lead to unauthorized access to restricted data, the ability to bypass security controls, or the disruption of web services.
Technical details
Hiawatha (up to version 12.1) contains an HTTP Request Smuggling vulnerability (CWE-444) caused by two flaws. First, the core parser in 'src/http.c' incorrectly prioritizes the Content-Length header over Transfer-Encoding, violating RFC 9112. Second, the reverse proxy module in 'src/rproxy.c' fails to strip the Content-Length header when forwarding chunked requests. An unauthenticated remote attacker can exploit these flaws to desynchronize front-end and back-end connections (TE.CL or CL.TE scenarios). This allows for request hijacking, security filter bypass, or cache poisoning. The issue is resolved in version 12.2 by rejecting requests containing both headers with a 400 Bad Request error.
Affected products
- Hugo Leisink Hiawatha <= 12.1
Timeline
- 2026-07-23: disclosed: Technical advisory published by Fenrisk
- 2026-07-31: advisory: CVE-2026-51785 published by NVD/MITRE
- 2026-07-31: patched: Fixed in version 12.2