CVE-2005-3751

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-11-22 · updated 2026-06-16

Description

HTTP request smuggling vulnerability in Pound before 1.9.4 allows remote attackers to poison web caches, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with conflicting Content-length and Transfer-encoding headers.

Affected products

Apsis Pound: through 1.9.3

References

http://secunia.com/advisories/18367
http://secunia.com/advisories/18381
http://secunia.com/advisories/20215
http://secunia.com/advisories/20510
http://www.apsis.ch/pound/pound_list/archive/2005/2005-10/1129827166000/index_html?fullMode=1#1129827166000
http://www.debian.org/security/2005/dsa-934
http://www.gentoo.org/security/en/glsa/glsa-200606-05.xml
http://www.novell.com/linux/security/advisories/2006_05_19.html
http://secunia.com/advisories/18367
http://secunia.com/advisories/18381
http://secunia.com/advisories/20215
http://secunia.com/advisories/20510

Get alerted when CVE-2005-3751 or the next vulnerability affects your stack