CVE-2026-65370

Awaiting Analysis Awaiting Analysis - Queue

ServiceTalk HTTP Request Smuggling Vulnerability

Publication date: 2026-08-12

Last updated on: 2026-08-13

Assigner: Apple Inc.

Description

ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk version 0.42.65.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-13

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-65370

Affected Vendors & Products

Vendor	Product	Version / Range
apple	servicetalk	0.42.65

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

ServiceTalk HTTP/1.x has a flaw in handling malformed Transfer-Encoding headers, which could allow attackers to perform request smuggling attacks. This occurs when the system misinterprets malformed requests, potentially leading to unauthorized access or data manipulation.

Detection Guidance

To detect this vulnerability, inspect HTTP/1.x traffic for malformed Transfer-Encoding headers. Use tools like Wireshark or tcpdump to capture and analyze network traffic for abnormal request patterns. Check server logs for inconsistent request parsing or smuggling attempts. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to bypass security controls, access sensitive data, or interfere with normal operations by smuggling malicious requests through the system. Users of affected ServiceTalk versions may face data breaches or service disruptions.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Upgrade ServiceTalk to version 0.42.65 or later to address the vulnerability. If upgrading is not immediately possible, implement network-level protections such as WAF rules to block malformed Transfer-Encoding headers. Monitor for suspicious activity and apply patches as soon as available.

Hi! I’m here to help you understand CVE-2026-65370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70