CVE-2026-77803: Telerik Fiddler Classic Desync Vulnerability

CVE-2026-77803 Overview

CVE-2026-77803 is a front-end HTTP request desynchronization vulnerability in Progress Telerik Fiddler Classic for Windows. The flaw exists in the proxy request forwarding component in versions prior to v6.0.20262.10021. Fiddler forwards requests containing both Content-Length and Transfer-Encoding headers with both headers intact, while framing the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request. A local, low-privileged threat actor can split a single malformed request into two forwarded requests and receive a smuggled response, without requiring a vulnerable origin server. The weakness is classified as CWE-444: Inconsistent Interpretation of HTTP Requests.

Critical Impact
Local attackers can smuggle HTTP requests through Fiddler Classic's proxy, yielding limited confidentiality and integrity impact against intercepted traffic.

Affected Products

Progress Telerik Fiddler Classic for Windows (all versions prior to v6.0.20262.10021)
Deployments using Fiddler Classic as an intercepting HTTP proxy
Developer and QA workstations running Fiddler Classic for request inspection

Discovery Timeline

2026-10-05 - CVE-2026-77803 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-77803

Vulnerability Analysis

The vulnerability is a classic HTTP Request Smuggling condition stemming from inconsistent handling of request framing headers. HTTP/1.1 specifies that when both Content-Length (CL) and Transfer-Encoding (TE) headers appear in a single request, the Transfer-Encoding: chunked header must take precedence and the Content-Length must be removed before forwarding. Fiddler Classic violates this requirement.

Fiddler frames the inbound request body using Transfer-Encoding only, correctly parsing the chunked payload. However, when forwarding the request upstream, it retains both headers. The origin server, or any intermediate parser that honors Content-Length first, interprets the request differently from Fiddler. This desynchronization allows an attacker to append a second request inside the body of the first.

Because Fiddler reuses the client-side connection, the bytes left after the first chunked body are parsed as a pipelined request. The attacker receives the smuggled response on their own connection without needing to compromise or probe the backend.

Root Cause

The root cause is improper enforcement of RFC 7230 §3.3.3 framing rules in Fiddler Classic's proxy request forwarding component. Rather than normalizing requests by stripping the conflicting Content-Length header when Transfer-Encoding: chunked is present, the proxy forwards both headers verbatim.

Attack Vector

Exploitation requires local, low-privileged access to a workstation running Fiddler Classic. The attacker crafts a single HTTP request containing both framing headers, with a smuggled second request embedded in the chunked body. Fiddler forwards the combined payload, and the smuggled request executes against the configured upstream destination. The attack is self-contained and does not depend on a vulnerable origin server.

See the Telerik Security Advisory for CVE-2026-77803 for the vendor's technical description.

Detection Methods for CVE-2026-77803

Indicators of Compromise

HTTP requests captured by Fiddler Classic containing both Content-Length and Transfer-Encoding: chunked headers in the same message.
Unexpected pipelined requests on client connections traversing Fiddler, particularly requests the user did not initiate.
Fiddler session logs showing paired requests where the second request's method or path does not match any user action.

Detection Strategies

Inspect Fiddler Classic session archives (.saz files) for requests containing conflicting framing headers.
Review proxy forwarding logs for anomalous back-to-back requests from the same local client within sub-millisecond intervals.
Correlate workstation process telemetry for Fiddler.exe executions with outbound HTTP traffic patterns indicative of smuggling payloads.

Monitoring Recommendations

Enable verbose logging in Fiddler Classic on developer and QA workstations where the tool remains in use pending upgrade.
Monitor endpoint telemetry for installation and execution of Fiddler Classic versions below v6.0.20262.10021.
Alert on HTTP traffic from workstations containing malformed framing header combinations to upstream services.

How to Mitigate CVE-2026-77803

Immediate Actions Required

Upgrade Progress Telerik Fiddler Classic to version v6.0.20262.10021 or later on all workstations.
Inventory endpoints with Fiddler Classic installed and prioritize upgrade for machines handling sensitive HTTP traffic.
Restrict local user privileges on shared workstations where Fiddler Classic is installed to limit abuse by low-privileged accounts.

Patch Information

Progress has released a fixed build in Fiddler Classic v6.0.20262.10021. The patch addresses the proxy request forwarding component to normalize framing headers before upstream forwarding. Refer to the Telerik Security Advisory for CVE-2026-77803 for the official remediation guidance.

Workarounds

Disable Fiddler Classic's system-wide proxy capture when the tool is not actively in use.
Migrate to Fiddler Everywhere or an alternative inspection proxy that enforces RFC-compliant request normalization.
Block Fiddler Classic from forwarding to production or sensitive upstream services via host firewall rules until patched.

bash

# Verify installed Fiddler Classic version on Windows endpoints
(Get-Item "C:\Program Files (x86)\Fiddler2\Fiddler.exe").VersionInfo.FileVersion

# Expected output after patch: 6.0.20262.10021 or higher