Sebastiano Sartor

When a client sends a POST request with the `Expect: 100-continue` header and the origin server responds before reading the body, the software parses the unread body remaining on the client connection as the subsequent request. An attacker positioned behind a front-end proxy that shares connections to the server can exploit this behavior to smuggle requests past the front end and desynchronize responses for other users.

An issue exists where the software cannot properly parse the trailer section in a malformed trailer header line. This flaw can be leveraged to perform HTTP request smuggling, a technique used to interfere with the way a website processes sequences of HTTP requests.

The issue is related to improper control of code generation, allowing for code injection, and also involves cross-site request forgery (CSRF) and improper neutralization of special elements used in a template engine. This could potentially enable a remote attacker to perform a server-side request forgery (SSRF) attack.