PT-2026-4738 · Unknown · Altitude Communication Server

Published 2026-01-26 · Updated 2026-01-26 · CVE-2025-41082

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Altitude Communication Server (affected versions not specified)

Description An issue exists in Altitude Communication Server related to the handling of HTTP requests. Inconsistent analysis of multiple HTTP requests over a single Keep-Alive connection, specifically utilizing Content-Length headers, can lead to a desynchronization between frontend and backend servers. This desynchronization may allow for request hiding, cache poisoning, or security bypass.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2025-41082

Affected Products

Altitude Communication Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-41082 · Security Note
• https://twitter.com/VulmonFeeds/status/2015787729422831871 · Twitter Post
• https://t.me/CVEtracker/42990 · Telegram Post
• https://t.me/cveNotify/149841 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-altitude-communication-server · Note