CVE-2025-12874 HTTP Request Smuggling in Quest Coexistence Manager for Notes
HTTP request smuggling in Quest Coexistence Manager for Notes allows attackers to bypass access controls, poison caches, or hijack sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12874?
CVE-2025-12874 is a medium-severity vulnerability in Quest Coexistence Manager for Notes, published on 19 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Quest Coexistence Manager for Notes (Free/Busy Connector modules) allows HTTP Request Smuggling via the Content-Length-Transfer-Encoding (CL.TE) attack vector. This could allow an attacker to bypass access controls, poison web caches, hijack sessions, or trigger unintended internal requests. This issue affects Coexistence Manager for Notes 3.8.2045. Other versions may also be affected.
Weakness: CWE-444
Which versions are affected by CVE-2025-12874?
How do I fix CVE-2025-12874?
No fix has been published for CVE-2025-12874 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-12874 being exploited?
There is no known exploitation of CVE-2025-12874 in the wild and no public exploit code.
Sources
Also known as GHSA-rcrh-rjwq-6v33.