CVE-2020-7659

Name of the Vulnerable Software and Affected Versions reel versions 0.6.1 and earlier

Description The issue allows for Request Smuggling attacks due to incorrect parsing of Content-Length and Transfer encoding headers. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Additionally, invalid Transfer Encoding headers are parsed as valid, which could be leveraged for TE:CL smuggling attacks. The project is deprecated and no longer maintained.

Recommendations For versions 0.6.1 and earlier, as a temporary workaround, consider restricting the use of the Content-Length header and validating Transfer Encoding headers to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.