Request Smuggling Vulnerability in ServiceTalk by Apple
CVE-2026-65370

Currently unrated

Key Information:

Vendor

Apple
Status
Servicetalk
Vendor
CVE Published:
12 August 2026

What is CVE-2026-65370?

ServiceTalk HTTP/1.x has a vulnerability that improperly handles malformed Transfer-Encoding headers, potentially allowing attackers to execute request smuggling attacks. This issue can mislead downstream servers, enabling malicious actors to exploit application vulnerabilities seamlessly. Users are encouraged to update to version 0.42.65 or later to mitigate this risk effectively.

Affected Version(s)

servicetalk 0 < 0.42.65

References

https://github.com/apple/servicetalk/security/advisories/...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.