https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T17:33:05.606838+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2020-7670 CVE-2020-7670 2026-10-12T17:33:05.608469+00:00

Affected: agoo

agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks where `agoo` is used as part of a chain of backend servers due to insufficient `Content-Length` and `Transfer Encoding` parsing.

 https://cve.radiocsirt.org/vuln/ghsa-h385-52j6-9984 Withdrawn: GHSA-h385-52j6-9984 — Withdrawn: HTTP Request Smuggling in Agoo 2026-10-12T17:33:05.608516+00:00

Withdrawn by the publisher.

Affected: RubyGems: agoo

# Withdrawn reason Withdrawn on 1/13/2021 due to [this comment from the maintainer](https://github.com/ohler55/agoo/issues/88#issuecomment-723580783). This is no longer considered a vulnerability.

# Original description agoo through 2.12.3 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.