CVE-2026-77802 Overview
CVE-2026-77802 is an HTTP Request Smuggling vulnerability [CWE-444] in Progress® Telerik® Fiddler® Classic for Windows versions prior to v6.0.20262.10021. The proxy request forwarding component accepts requests containing multiple Content-Length headers with conflicting values and forwards them verbatim to the origin server. Fiddler itself frames the request body using only the first Content-Length value, creating a desynchronization between the proxy and the origin. A local, low-privileged attacker sharing the same Fiddler proxy instance can exploit this behavior to poison responses delivered to other users and read responses intended for them.
Critical Impact
Shared Fiddler proxy users face response poisoning and cross-session data disclosure through smuggled requests retained in reused keep-alive connections.
Affected Products
- Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021
- Shared Fiddler proxy deployments where multiple users route traffic through a single instance
- Environments connecting Fiddler to non-RFC-9110-compliant origin servers that keep connections alive
Discovery Timeline
- 2026-10-05 - CVE-2026-77802 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-77802
Vulnerability Analysis
The flaw is a classic CL.CL (Content-Length / Content-Length) HTTP request smuggling condition inside Fiddler's proxy forwarding path. When a client sends a request carrying two or more Content-Length headers with conflicting values, Fiddler forwards all headers unchanged to the origin server. Fiddler then parses the request body using only the first Content-Length value it reads.
If the origin server is not RFC 9110 compliant and selects a different Content-Length value, the two endpoints disagree on where the request ends. The attacker-supplied trailing bytes are interpreted by the origin as the start of a new, smuggled HTTP request. Because Fiddler returns the server socket to its pipe pool after reading only the first response, the smuggled response remains buffered on that connection.
The next session reusing that pooled connection receives the stale, attacker-influenced response, enabling response poisoning and disclosure of another user's traffic.
Root Cause
The root cause is improper interpretation and normalization of HTTP request headers in the proxy forwarder. Fiddler neither rejects nor rewrites requests containing duplicate Content-Length headers, violating the strict framing requirements of RFC 9110. Combined with connection pooling that assumes a clean socket state after one response, this parser disagreement enables the smuggling primitive.
Attack Vector
Exploitation requires local access with low privileges and the ability to send requests through the same Fiddler proxy instance as another user. The attacker crafts a single HTTP request containing two Content-Length headers whose values differ, with a smuggled request appended to the body. Fiddler forwards the request, consumes only the first response, and returns the socket to the pool. When a victim session reuses that connection, Fiddler serves the buffered smuggled response to the victim, poisoning their view or exposing data from the attacker's prior interaction with the origin. Technical specifics are documented in the Telerik Security Advisory CVE-2026-77802.
Detection Methods for CVE-2026-77802
Indicators of Compromise
- HTTP requests traversing a Fiddler proxy that contain more than one Content-Length header, or a Content-Length header alongside a Transfer-Encoding: chunked header.
- Unexpected response bodies or mismatched Content-Type values delivered to Fiddler users that do not correlate with their issued requests.
- Origin server access logs showing adjacent requests from a single Fiddler-sourced TCP connection where the second request was never issued by any known client.
Detection Strategies
- Inspect proxied HTTP traffic for duplicate Content-Length headers and alert on any request that violates RFC 9110 framing rules.
- Correlate Fiddler session logs with origin server logs to identify response bodies served to a session that do not match the request issued by that session.
- Monitor for abnormal reuse patterns on pooled keep-alive connections, especially bursts of short, back-to-back requests from a single local user.
Monitoring Recommendations
- Enable verbose request and response logging in Fiddler and forward logs to a centralized analytics platform for header-level inspection.
- Track Fiddler process versions across workstations to confirm all instances are at v6.0.20262.10021 or later.
- Audit which users share a single Fiddler proxy instance and alert on new local connections to the Fiddler listener port.
How to Mitigate CVE-2026-77802
Immediate Actions Required
- Upgrade all Fiddler Classic for Windows installations to v6.0.20262.10021 or later.
- Discontinue the practice of sharing a single Fiddler proxy instance across multiple users until patched.
- Restrict the Fiddler listener to loopback or trusted local accounts only, blocking remote and multi-user access.
Patch Information
Progress has released Fiddler Classic v6.0.20262.10021, which addresses the request smuggling condition. See the Telerik Security Advisory CVE-2026-77802 for official remediation details and download guidance.
Workarounds
- Disable the Fiddler proxy's connection pooling or keep-alive reuse so that each request uses a fresh server connection.
- Place a hardened, RFC-9110-compliant reverse proxy in front of origin servers to reject requests with duplicate Content-Length headers.
- Where feasible, migrate users to individual Fiddler instances rather than a shared proxy to eliminate the cross-user exposure path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
