The vulnerability stems from inconsistent interpretation of HTTP requests in the liteide HTTP parser module, allowing an attacker to smuggle a second request into a single HTTP stream. This behavior can be exploited to bypass security checks, execute unintended commands, or redirect traffic, potentially compromising application data and integrity. The weakness falls under CWE‑444, which describes ways attackers can manipulate HTTP headers to alter request handling.

All installations of visualfc liteide prior to version x38.4 are affected. The flaw resides in the http_parser component of the liteide source tree and can be triggered when the application receives HTTP traffic from an external client.

The CVSS score of 2.9 indicates low overall severity, and there is no EPSS score provided; the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is inferred from the description to involve carefully constructed HTTP requests sent to the liteide server, which would require network-level access to the target. While the potential impact is moderate—primarily affecting request integrity and potentially bypassing application controls—the low score suggests that widespread exploitation is currently unlikely, though caution remains warranted.