CVE-2026-65370: ServiceTalk HTTP Smuggling Vulnerability

CVE-2026-65370 Overview

CVE-2026-65370 is an HTTP request smuggling vulnerability in Apple's ServiceTalk framework. ServiceTalk is a JVM network application framework used to build resilient microservices. The vulnerability stems from incorrect handling of malformed Transfer-Encoding headers in the HTTP/1.x parser. Attackers can exploit this parsing inconsistency to smuggle requests through intermediary proxies to backend servers.

The issue is fixed in ServiceTalk version 0.42.65. Applications running earlier versions that expose HTTP/1.x endpoints or sit behind HTTP proxies are exposed to request smuggling attacks.

Critical Impact
Request smuggling can bypass front-end security controls, poison web caches, hijack user sessions, and route unauthorized requests to backend services.

Affected Products

Apple ServiceTalk HTTP/1.x versions prior to 0.42.65
JVM microservices built on ServiceTalk HTTP/1.x transport
Applications relying on ServiceTalk as a reverse proxy or HTTP gateway

Discovery Timeline

2026-08-12 - CVE-2026-65370 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-65370

Vulnerability Analysis

HTTP request smuggling occurs when a front-end server and back-end server disagree on where one HTTP request ends and the next begins. ServiceTalk's HTTP/1.x parser accepts malformed Transfer-Encoding headers that other HTTP implementations may reject or interpret differently. This parser desynchronization allows an attacker to inject a second request within the body of a first request. See the ServiceTalk GitHub Security Advisory GHSA-56h2-h3h4-m9x6 for the vendor-authored description.

The smuggled request bypasses controls applied by upstream proxies, load balancers, or web application firewalls. Downstream ServiceTalk instances then process the injected request as a separate, trusted transaction. This class of flaw is tracked as HTTP Request Smuggling and typically maps to [CWE-444].

Root Cause

The root cause is improper validation of the Transfer-Encoding header field. RFC 9112 requires strict handling of chunked encoding indicators and rejection of ambiguous forms. ServiceTalk's HTTP/1.x codec accepts malformed variants, which can be interpreted differently by upstream infrastructure. When a proxy and ServiceTalk parse the same message with different framing, a boundary confusion emerges.

Attack Vector

An unauthenticated remote attacker crafts an HTTP/1.x request containing a malformed Transfer-Encoding header alongside a Content-Length header, or a Transfer-Encoding value that the proxy ignores but ServiceTalk honors. The attacker sends this request to a public endpoint fronted by a proxy that forwards traffic to ServiceTalk. The two parsers disagree on message boundaries, leaving a partial second request queued on the shared connection.

The smuggled request can target internal API paths, forge session cookies for other users, or poison shared response caches. Exploitation requires no authentication and no user interaction.

Technical exploitation details are described in the ServiceTalk security advisory. No public proof-of-concept is referenced in the enriched data.

Detection Methods for CVE-2026-65370

Indicators of Compromise

HTTP/1.x requests containing both Transfer-Encoding and Content-Length headers targeting ServiceTalk endpoints
Transfer-Encoding header values with unusual whitespace, casing, or duplicated entries such as Transfer-Encoding: chunked, identity
Backend access logs showing requests with methods, paths, or hosts that could not have originated from the front-end proxy
Unexpected 400-class responses correlated with follow-up requests from the same client IP within milliseconds

Detection Strategies

Deploy WAF or reverse-proxy rules that reject requests containing conflicting or malformed framing headers
Compare front-end proxy access logs against ServiceTalk backend logs to identify request count or URI mismatches
Enable HTTP/2 or strict HTTP/1.1 mode on all reverse proxies to reduce parser divergence surface

Monitoring Recommendations

Alert on repeated Transfer-Encoding header anomalies from single source addresses
Monitor for sudden spikes in cached responses served to unrelated users, which can indicate cache poisoning
Track connection reuse anomalies on keep-alive channels between proxies and ServiceTalk instances

How to Mitigate CVE-2026-65370

Immediate Actions Required

Upgrade all ServiceTalk deployments to version 0.42.65 or later
Inventory JVM services and third-party libraries that transitively depend on ServiceTalk HTTP/1.x
Terminate long-lived HTTP/1.x keep-alive connections after the upgrade to flush any smuggled state

Patch Information

The vulnerability is fixed in ServiceTalk 0.42.65. Update Maven or Gradle dependency declarations to pin ServiceTalk artifacts to the patched release. Review the GitHub Security Advisory GHSA-56h2-h3h4-m9x6 for the complete list of affected modules and the patched commit.

Workarounds

Place a strict HTTP-parsing proxy in front of ServiceTalk that rejects requests with both Transfer-Encoding and Content-Length headers
Disable HTTP/1.x keep-alive on the perimeter and force one request per connection until the patch is deployed
Restrict exposed HTTP/1.x endpoints to trusted networks where feasible

bash

# Example Gradle dependency pin to the patched ServiceTalk release
implementation 'io.servicetalk:servicetalk-http-netty:0.42.65'