CVE-2005-2089

Microsoft IIS 5.0 and 6.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes IIS to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

• CWE-444

• http://seclists.org/lists/bugtraq/2005/Jun/0025.htmlMailing List, Third Party Advisory
• http://www.securiteam.com/securityreviews/5GP0220G0U.htmlBroken Link
• http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdfBroken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42899Third Party Advisory, VDB Entry
• http://seclists.org/lists/bugtraq/2005/Jun/0025.htmlMailing List, Third Party Advisory
• http://www.securiteam.com/securityreviews/5GP0220G0U.htmlBroken Link
• http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdfBroken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42899Third Party Advisory, VDB Entry

Published

Jul 5, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-2083Format string vulnerability in IMAP4 in IA eMailServer Corpo…
• CVE-2005-2084Cross-site scripting (XSS) vulnerability in SearchResults.as…
• CVE-2005-2085Buffer overflow in Inframail Advantage Server Edition 6.0 th…
• CVE-2005-2086PHP remote file inclusion vulnerability in viewtopic.php in …
• CVE-2005-2087Internet Explorer 5.01 SP4 up to 6 on various Windows operat…
• CVE-2005-2088The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.5…
• CVE-2005-2090Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote…
• CVE-2005-2091IBM WebSphere 5.1 and WebSphere 5.0 allows remote attackers …
• CVE-2005-2092BEA Systems WebLogic 8.1 SP1 allows remote attackers to pois…
• CVE-2005-2093Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remot…
• CVE-2005-2094Sun SunONE web server 6.1 SP1 allows remote attackers to poi…
• CVE-2005-2095options_identities.php in SquirrelMail 1.4.4 and earlier use…