Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CL.0 desync in",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "shed riot"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# Summary\n\nI reported the issue to the Microsoft Security Response Center twice:\n\n* VULN-165381, MSRC case 102964\n* VULN-165876, MSRC case 103259\n\nIn both cases, they do not appear to have even looked at the PoCs, and so\nhave failed to adequately investigate before reaching a decision.\n\n\n# Vulnerability\n\nCWE-444: HTTP Request/Response Smuggling\n\nThe observed behaviour was consistent with CL.0 HTTP desync within the\nrequest-processing chain.\n\n\n# Impact\n\nHTTP desync can cause attacker-controlled bytes to be interpreted as\nthe beginning of another request on a shared back-end connection.\n\nDepending on routing and connection reuse, this vulnerability class\ncan potentially be used to:\n\n* alter or prefix another user\u0027s request;\n* redirect users to attacker-controlled content;\n* deliver reflected or stored client-side payloads;\n* poison application or intermediary responses; or\n* disclose information associated with another request or user.\n\nI deliberately limited testing to a non-destructive proof of concept.\nI did not attempt to deliver an active payload to unrelated Microsoft\nusers or extract their data.\n\nTesting a desync issue against production infrastructure can affect\nthird-party requests. A fully weaponised test would therefore have\ncreated an unacceptable risk to legitimate users.\n\n\n# Proof of concept\n\nThe supplied proof of concept used two independent clients.\n\nThe attacker client submitted a crafted request containing bytes\nafter the declared request body.\n\nThe victim client then made an ordinary request.\n\nThe attacker-controlled content was subsequently observed in the\nvictim-side transaction.\n\nThe result demonstrated cross-request interference, rather than an\nunusual response confined to the attacker\u0027s own connection.\n\nThe second submission also included screenshots, as MSRC couldn\u0027t\nbe arsed to run the PoCs themselves.\n\n\n# Timeline\n\n26 October 2025\n\nI submitted the initial report as VULN-165381 and uploaded separate\nexploit and victim scripts.\n\n27 October 2025\n\nMSRC opened case 102964.\n\n29 October 2025\n\nMSRC requested a video and asked which internal component was\naffected.\n\n30 October 2025\n\nI explained that a video would only show the supplied scripts running.\nMicrosoft would need to trace the crafted request through its own\napplication stack to identify where it was split.\n\nI also asked whether MSRC had run the scripts.\n\n31 October 2025\n\nMSRC closed the case as \"not a vulnerability\".\n\n4 November 2025\n\nI submitted the issue again as VULN-165876, including the scripts and\nscreenshots showing the attacker, victim and successful result.\n\n5 November 2025\n\nMSRC opened case 103259.\n\n10 November 2025\n\nMSRC stated that it required a proof of concept \"demonstrating an\nexploit\", despite the scripts already having been supplied. The\nresponses indicate that the proof of concept had not been run.\n\n18 November 2025\n\nI asked whether MSRC had run and validated the proof of concept.\n\n19 November 2025\n\nMicrosoft closed the second case, stating:\n\n\"You have not submitted sufficient evidence of HTTP desync. You have\nonly provided 2 shell scripts and no other information confirming that\nthe exploit works.\"\n\nThe second submission also contained screenshots demonstrating the\nattacker, victim and successful result.\n\n20 November 2025\n\nI challenged the assessment and pointed out that the proof of concept\ndisplayed the issue clearly, and that both reports appeared to have\nbeen closed without MSRC running the PoC.\n\nMSRC maintained its position and requested a copy of the disclosure\ndraft for technical review.\n\n\n# Resolution\n\nMicrosoft closed both reports and stated that it would not track the\nissue further. At no point do they appear to have run any of the\nsupplied PoC scripts.\n\nThe vuln still exists, and isn\u0027t difficult to find for someone\nwilling to scan the site. Fill your boots!\n\n\n# References\n\n* MSRC submission VULN-165381, case 102964\n* MSRC submission VULN-165876, case 103259\n* CWE-444: HTTP Request/Response Smuggling\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:20Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/34"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/34"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/34"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CL.0 desync in www.microsoft.com",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0018",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/34",
            "automated": true,
            "contentSha256": "83e21e0436aedf0f26b610ca7610d2996cc8ba9f3a945e9e3bd958728660b536",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/34",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-24T09:21:16Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-07T13:20:20Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0018"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}