CVE-2026-51785 Details

A remote code execution vulnerability has been identified in Hugo Leisink Hiawatha versions through 12.1. This vulnerability arises from improper handling of HTTP requests that include both 'Transfer-Encoding' and 'Content-Length' headers. Hiawatha prioritizes 'Content-Length' over 'Transfer-Encoding', contrary to RFC 9112, and when acting as a reverse proxy, it forwards the request to the backend without removing the original 'Content-Length' header. An attacker can exploit this flaw to desynchronize the frontend and backend servers, potentially leading to unauthorized code execution.

Upgrade to Hiawatha version 12.2 or later, which addresses this vulnerability by properly handling ambiguous 'Content-Length' and 'Transfer-Encoding' requests. If an immediate upgrade is not possible, consider using a standards-compliant proxy to reject or normalize such requests before they reach the Hiawatha server.