A parsing flaw in Kong's HTTP request processing pipeline allows an attacker to smuggle requests and cause desynchronization when handling untrusted HTTP/1.1 traffic. This can lead to manipulations such as request forging, data leakage or denial of service, compromising the confidentiality and integrity of traffic passing through the gateway.

Kong Enterprise Gateway, versions 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14. All affected series are impacted by the flaw.

The vulnerability carries a CVSS score of 4.9, indicating moderate severity, and no EPSS score is available. It is not listed in CISA's KEV catalog. The likely attack vector is crafting malicious HTTP/1.1 requests to the gateway, exploiting the parsing defect in a network-facing scenario. No privileged access is required beyond the ability to send traffic to the affected gateway.