CVE-2026-40562 Details
Description
Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Gazelle incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
A vulnerability allowing HTTP request smuggling has been identified in Gazelle versions through 0.49 for Perl. This issue arises from the application incorrectly prioritizing the 'Content-Length' header over 'Transfer-Encoding: chunked' when both are present in an HTTP request. According to RFC 7230 section 3.3.3, 'Transfer-Encoding' should take precedence. An attacker could exploit this vulnerability to send malicious HTTP requests through a front-end reverse proxy, potentially bypassing security measures or manipulating request handling.
Users are advised to upgrade to Gazelle version 0.49 or later, or to apply the available patch.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3 | CPANSec | Third Party Advisory |
| https://metacpan.org/release/KAZEBURO/Gazelle-0.50/changes | CPANSec | Release Notes |
| https://security.metacpan.org/patches/G/Gazelle/0.49/CVE-2026-40562-r1.patch | CPANSec | Patch |
| http://www.openwall.com/lists/oss-security/2026/05/06/7 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| kazeburo gazelle | < 0.50 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 7, 2026 | CVE Modified | CPANSec |
| May 6, 2026 | CVE Modified | CVE |
| May 6, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | New CVE Received | CPANSec |