CVE-2026-103995
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Response body and chunk parsing would handle non-hex or negative integers incorrectly, which could result in misinterpreting HTTP response contents. This may cause incorrect data processing by the HTTP client.
Risk Assessment
Misinterpretation of HTTP responses can lead to unexpected application behavior, including logic errors or potential security bypasses. The risk depends on the context of HTTP client usage.
Recommendation
Update the HTTP client library to a version containing the fix. If unavailable, consider validating or limiting trust in processed HTTP responses.
Other vulnerabilities in HTTP client library
See all- CVE-2025-4673Medium
A vulnerability in cross-origin redirect handling causes Proxy-Authorization and Proxy-Authenticate headers to persist, potentially leaking sensitive authentication data.
- CVE-2026-90455Low
A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a single fixed, trusted vendor URL at initialization and does not process attacker-controlled input through the library.
Original NVD description (English source)
Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS