HTTP request smuggling is possible in Progress Telerik Fiddler Classic prior to v6.0.20262.10021. The proxy forwards requests containing multiple conflicting Content‑Length headers. Fiddler frames the request body using only the first header value, while the entire request is sent to the origin server. A low‑privileged local user can send a specially crafted request that smuggles an additional request to a non‑RFC‑9110‑compliant server, causing the server to keep the connection alive, thereby allowing the attacker to read or inject responses destined for other users.

Affected product: Progress Telerik Fiddler Classic for Windows. All releases before v6.0.20262.10021 are vulnerable.

CVSS 6.3 indicates moderate severity. EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local low‑privileged user who can send traffic through the same proxy instance, enabling smuggling against a non‑RFC‑9110‑compliant origin server that keeps connections alive. The risk is that an attacker could poison responses delivered to other users, exposing confidential information or manipulating traffic.