The vulnerability resides in the handling of HTTP chunked transfer-encoding trailers by the Gleam web server “ewe”. When a request contains a Trailer header that declares additional header fields, the server merges these into the request header table after parsing the body. The whitelist used to block dangerous headers only excludes nine names, leaving the rest open to abuse. A malicious client can therefore send deliberately chosen trailer fields such as X-Forwarded-For, X-Authenticated-User, or other authentication-related headers. Upon receipt, ewe overwrites normal header values set by upstream reverse proxies. The result is that an attacker can forge authentication credentials, hijack user sessions, bypass IP‑based rate limiting, or insert proxy‑trust headers that downstream middleware will honor. This is effectively an authentication bypass that can lead to privilege escalation and data compromise.

The affected product is the Gleam web server named “ewe” developed by vshakitskiy. Versions from 0.6.0 up to and including 3.0.4 are vulnerable. The vulnerability was addressed in release 3.0.5, which removes the permissive handling of trailer headers.

The impact rating is moderate with a CVSS score of 5.3, while the EPSS score indicates a very low probability of exploitation (<1 %). The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, reducing current threat visibility. Attackers can exploit the weakness remotely by forging an HTTP request that includes chunked transfer‑encoding trailers. No privilege or authentication is required, so a remote attacker from the internet could potentially prepare a crafted client and send a malicious request. The overall risk is therefore moderate but the likelihood of active exploitation is low.