Front‑end request desynchronization is possible in the proxy request forwarding component of Progress® Telerik® Fiddler® Classic for Windows. A client request that contains both a Content‑Length header and a Transfer‑Encoding header is forwarded to the origin server with both headers present, while Fiddler frames the body using Transfer‑Encoding only. The remaining bytes on the reused client connection are subsequently parsed as a separate pipelined request. A local threat actor with low privileges can therefore split a single malformed request into two, forward them the origin server, and receive an additional smuggled response, without needing to compromise the origin server.

Affected systems are Progress Software's Telerik® Fiddler® Classic for Windows, all releases prior to v6.0.20262.10021. The vulnerability exists in the proxy request forwarding component and requires local user privileges to craft a malicious request.

The CVSS score of 3.6 indicates low severity, and the EPSS score is not available. KEV does not list this vulnerability, implying a low public exploitation probability. Nevertheless, the flaw can be exploited by any local user who can control requests to the proxy, and the only mitigations that remove the attack surface are disabling client connection reuse via the Tools > Options > Connections settings or upgrading to a patched version. Until a patch is released, the vulnerability remains an exploitable local threat.