CVE-2026-77803: progress software progress® telerik® fiddler® classic HTTP Request/Response Smuggling

Vulnerability summary

CVE-2026-77803 is a low (CVSS 3.6) HTTP Request/Response Smuggling vulnerability in progress software progress® telerik® fiddler® classic. EPSS estimates a 0.09% chance of exploitation in the next 30 days, higher than 0.3% of scored vulnerabilities.

Timeline

1. 05-10-2026
   PublishedVulnerability first disclosed.
2. 06-10-2026
   Last modifiedVulnerability information updated.

Description

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server.

• CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.