# Apache HTTP Request Parsing Whitespace Defects

Apache httpd before 2.4.25 treated bare CR, FF, VTAB and HTAB as whitespace in request lines and headers, enabling request smuggling in proxy chains.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: regilero
- Disclosed: 2017-07-11
- CVE: CVE-2016-8743, CVE-2015-3183, CVE-2015-5739, CVE-2015-5740, CVE-2016-2086, CVE-2015-8852, CVE-2016-6816
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/244459
- Library page: https://bugbountylibrary.com/r/h1%3A244459
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:nginx technique:parser-differential technique:source-review vuln:request-smuggling

**Target:** HTTP request parser (request line and header parsing) in Apache httpd
**Root cause:** httpd accepted non-RFC7230 whitespace (bare CR, FF, VTAB, HTAB) as field separators in the request line and header lines, and honored bare CR before the ':' delimiter and retained bare CR in header values, so a downstream agent that treats those CTLs differently parses a different request boundary.
**Steps:**
1. Send a request line using bare CR / FF / VTAB / HTAB as separators instead of single SP, e.g. method and target separated by an unusual whitespace byte.
2. Include a bare CR before the ':' in a header field name; httpd honors it as whitespace.
3. Place a bare CR inside a header field value; httpd retains it in the input headers array.
4. Front httpd with a proxy/backend that does not treat these CTLs as whitespace; the backend sees request A as A + A'.
5. On a keepalive connection, submit requests A and B to the first proxy; the proxy may map response A' to request B, poisoning cache or serving A' to another user.
**How found:** Compared httpd's request-line and header parsing against RFC7230 sections 3.1.1, 3.2, 3.2.3, 3.2.4 and 3.5, noting httpd accepted implied whitespace and CTL characters the spec forbids.
**Exploitation:** In a proxy chain, an attacker crafts a request whose whitespace/CTL handling differs between the front proxy and the backend. The backend interprets the smuggled prefix as an extra request A', and on a keepalive connection the proxy attributes response A' to the victim's request B, enabling cache poisoning or cross-user response disclosure.
**Escalation:** Chaining with a keepalive proxy front-end turns a parsing discrepancy into cache poisoning or serving attacker-controlled content to other downstream users.
**Insight:** Audit the exact byte set each hop accepts as whitespace/separator in the request line and before the ':' in header names; any CTL (bare CR, FF, VTAB, HTAB) accepted by one parser but not the next is a smuggling primitive, especially where bare CR is retained in the stored request or header value.