PT-2026-37626 · Gazelle · Gazelle

Cpansec · Published 2026-05-06 · Updated 2026-05-11 · CVE-2026-40562

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gazelle versions prior to 0.50

Description Improper header precedence allows HTTP Request Smuggling. The software incorrectly prioritizes the Content-Length header over Transfer-Encoding: chunked when both are present in an HTTP request, violating RFC 7230 3.3.3. This allows an attacker to smuggle malicious HTTP requests through a front-end reverse proxy.

Recommendations Update to a version later than 0.49.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-40562

Affected Products

Gazelle

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-40562 · Security Note
• https://security.metacpan.org/patches/G/Gazelle/0.49/CVE-2026-40562-r1.patch · Patch
• http://openwall.com/lists/oss-security/2026/05/06/7 · Note
• https://t.me/cveNotify/163050 · Telegram Post
• https://twitter.com/CVEnew/status/2052037441234813420 · Twitter Post
• https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3 · Note
• https://twitter.com/infoflowcloud/status/2052038505690222772 · Twitter Post
• https://t.me/cveNotify/162587 · Telegram Post
• https://metacpan.org/release/KAZEBURO/Gazelle-0.50/changes · Note
• https://twitter.com/oss_security/status/2052050421271720383 · Twitter Post
• https://t.me/CVEtracker/52860 · Telegram Post