HTTP Request Smuggling Vulnerability in Gazelle for Perl

CVE-2026-40562

What is CVE-2026-40562?

The Gazelle for Perl application is susceptible to HTTP Request Smuggling due to improper header precedence, interpreting the 'Content-Length' header as more important than 'Transfer-Encoding: chunked' when both are present. This misconfiguration violates RFC 7230 section 3.3.3, which mandates that 'Transfer-Encoding' should take priority. As a result, attackers can exploit this issue to inject malicious HTTP requests through a front-end reverse proxy, leading to potential security breaches.

References