CVE-2026-40562: Gazelle for Perl Request Smuggling Flaw

CVE-2026-40562 Overview

CVE-2026-40562 is an HTTP Request Smuggling vulnerability in Gazelle, a Perl-based preforking HTTP server. The flaw affects Gazelle versions through 0.49. Gazelle incorrectly prioritizes the Content-Length header over Transfer-Encoding: chunked when both are present in an HTTP request. Per IETF RFC 7230 Section 3.3.3, Transfer-Encoding must take precedence. Attackers can exploit this header parsing inconsistency to smuggle malicious HTTP requests through a front-end reverse proxy. The vulnerability is tracked under [CWE-444] (Inconsistent Interpretation of HTTP Requests).

Critical Impact
Attackers can smuggle arbitrary HTTP requests past front-end proxies, enabling cache poisoning, request hijacking, and bypass of security controls enforced at the proxy layer.

Affected Products

Gazelle for Perl, all versions through 0.49
Deployments fronted by reverse proxies that forward both Content-Length and Transfer-Encoding headers
Web applications relying on Gazelle as the backend HTTP server

Discovery Timeline

2026-05-06 - CVE CVE-2026-40562 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-40562

Vulnerability Analysis

HTTP Request Smuggling exploits desynchronization between two HTTP servers that interpret request boundaries differently. In typical deployments, a front-end reverse proxy forwards requests to Gazelle as the backend. When a single request contains both a Content-Length and a Transfer-Encoding: chunked header, the two servers must agree on which boundary signal governs the request body. RFC 7230 mandates that Transfer-Encoding take precedence and that Content-Length be ignored or removed.

Gazelle violates this requirement by honoring Content-Length first. If the front-end proxy correctly applies Transfer-Encoding, the two systems disagree on where the request ends. The trailing bytes of one request are treated as the start of the next request by Gazelle. This desynchronization lets attackers inject a hidden second request that executes in the context of subsequent legitimate traffic.

Root Cause

The root cause is improper header precedence in Gazelle's request parser. The server selects Content-Length as the authoritative body delimiter when both headers are supplied. RFC 7230 Section 3.3.3 explicitly forbids this behavior to prevent smuggling. The 0.49 patch corrects the precedence logic so Transfer-Encoding: chunked is honored when present.

Attack Vector

The attack requires no authentication and no user interaction. An attacker sends a crafted HTTP request through a front-end proxy that fronts a Gazelle backend. The request contains conflicting Content-Length and Transfer-Encoding: chunked headers. The proxy processes the chunked body and forwards what it sees as one request, while Gazelle uses Content-Length and treats trailing bytes as a smuggled second request. Consequences include request queue poisoning, hijacking authenticated sessions of subsequent users, bypassing proxy-level access controls, and web cache poisoning. See the Metacpan Patch for CVE-2026-40562 for fix details.

Detection Methods for CVE-2026-40562

Indicators of Compromise

HTTP requests containing both Content-Length and Transfer-Encoding: chunked headers reaching Gazelle backends
Unexpected response pairing where users receive content intended for other sessions
Anomalous backend access log entries that show partial or malformed request lines following a prior request
Cache entries serving unexpected content for legitimate URLs

Detection Strategies

Inspect proxy and backend access logs for requests carrying both length-determining headers and alert on every occurrence
Compare front-end and back-end request counts for the same connection; mismatches indicate desynchronization
Deploy WAF or proxy rules that reject ambiguous requests rather than forwarding them
Hunt for sudden spikes in 400-class responses from Gazelle correlated with chunked transfer requests

Monitoring Recommendations

Enable verbose request-line logging on both the reverse proxy and Gazelle for forensic comparison
Monitor for repeated requests from the same client containing conflicting framing headers
Track cache hit anomalies and unexpected Set-Cookie reuse across distinct sessions

How to Mitigate CVE-2026-40562

Immediate Actions Required

Upgrade Gazelle to a version newer than 0.49 that incorporates the official patch
Configure the front-end reverse proxy to normalize or reject requests containing both Content-Length and Transfer-Encoding headers
Disable HTTP connection reuse between the proxy and Gazelle until patching is complete

Patch Information

The maintainers published a patch referenced as CVE-2026-40562-r1.patch on MetaCPAN. The fix corrects header precedence so Transfer-Encoding: chunked overrides Content-Length per RFC 7230 Section 3.3.3. Operators should rebuild and redeploy Gazelle from the patched source. Additional context is available on the OpenWall OSS-Security Mailing List.

Workarounds

Configure the upstream proxy (for example, nginx or HAProxy) to strip Content-Length whenever Transfer-Encoding: chunked is present
Reject any inbound request that supplies both headers at the edge
Terminate HTTP/1.1 keep-alive between the proxy and Gazelle to limit smuggling impact

bash

# Example nginx configuration to reject ambiguous framing
map $http_transfer_encoding $bad_framing {
    default        0;
    "~*chunked"    1;
}

server {
    listen 443 ssl;

    if ($bad_framing = 1) {
        # When chunked is present, ensure Content-Length is not forwarded
        proxy_set_header Content-Length "";
    }

    location / {
        proxy_http_version 1.1;
        proxy_set_header Connection "close";
        proxy_pass http://gazelle_backend;
    }
}