CVE-2026-65370

ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk version 0.42.65.

Score

CVSS 3.1 7.5 High

Status

Analyzed - product-security@apple.com

Published

2026-08-12

Last modified

2026-10-24

Weaknesses

CWE-444

Affected products

• Servicetalk (Apple)

References

• https://github.com/apple/servicetalk/security/advisories/GHSA-56h2-h3h4-m9x6