What’s Vulnerable › Vulnerabilities

CVE-2024-33452

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-22 · updated 2026-06-17
• Weakness: CWE-444

Description

An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.

Affected products

• openresty Lua-Nginx-Module: through 0.10.26

References

• https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn
• https://www.benasin.space/2025/03/18/OpenResty-lua-nginx-module-v0-10-26-HTTP-Request-Smuggling-in-HEAD-requests/
• https://lists.debian.org/debian-lts-announce/2025/06/msg00026.html

Get alerted when CVE-2024-33452 or the next vulnerability affects your stack