CVE-2021-41732

7.5 HIGH

An issue was discovered in zeek version 4.1.0

Published: 2021-09-29 · Last updated: 2026-06-17

Severity and scoring

CVSS: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE: CWE-444

Affected products

Vendor	Product
zeek	zeek

Description

An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE: the vendor's position is that the observed behavior is intended

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-41732
[Exploit reference]https://github.com/zeek/zeek/issues/1798
[Exploit reference]https://github.com/zeek/zeek/issues/1798

Related CVEs

Same CWE

CVE-2026-50020 — Netty is a network application framework for development of protocol servers and clients (5.3 MEDIUM)
CVE-2026-46342 — Nuxt is an open-source web development framework for Vue.js (5.4 MEDIUM)
CVE-2026-6338 — A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series
CVE-2026-41853 — Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks (5.3 MEDIUM)
CVE-2026-44546 — daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake proces... (3.7 LOW)