CVE-2025-1867

The vulnerability results from inconsistent interpretation of HTTP requests by the libhv library — a phenomenon known as HTTP Request/Response Smuggling. An attacker can craft a specially constructed HTTP request that will be interpreted differently by the frontend and backend servers (or by different traffic processing components). The discrepancy in interpretation allows smuggling of additional HTTP requests or responses that are not visible to intermediate security mechanisms. This does not require authentication or user interaction, and the attack is possible remotely over the network.

An attacker can gain unauthorized access to other users' data, bypass access control mechanisms, poison proxy caches, and consequently conduct further attacks on the infrastructure — including hijacking sessions or causing disclosure of sensitive information. The impact affects confidentiality, integrity, and availability of the system and related components.

Apply patches available from the vendor according to the references (pull request #689 in the ithewei/libhv GitHub repository). It is recommended to update the libhv library to a version newer than 1.3.3 immediately after its release and monitor the official project repository to confirm patch availability.

The libhv library in all versions up to and including 1.3.3.