Gazelle incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| KAZEBURO | Gazelle | unaffected |
|
No data.
No data.
No data available yet.
Vendor Workaround
Migrate to Starman version 0.4018 or newer which has fixed the issue. Or apply the patch.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 06 May 2026 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Gazelle incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy. | |
| Title | Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence | |
| Weaknesses | CWE-444 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-05-06T14:15:32.815Z
Reserved: 2026-04-14T11:35:53.644Z
Link: CVE-2026-40562
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-06T13:16:09.110
Modified: 2026-05-06T13:16:09.110
Link: CVE-2026-40562
Redhat
No data.
OpenCVE Enrichment
No data.