CVE-2026-65370 Other in servicetalk
Attackers can perform request smuggling via malformed Transfer-Encoding headers in ServiceTalk HTTP/1.x, bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-65370?
CVE-2026-65370 is a high-severity vulnerability in Apple servicetalk, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk version 0.42.65.
Weakness: CWE-444
Which versions are affected by CVE-2026-65370?
It affects 1 product.
Products include Apple Servicetalk.
How do I fix CVE-2026-65370?
No fix has been published for CVE-2026-65370 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-65370 being exploited?
There is no known exploitation of CVE-2026-65370 in the wild and no public exploit code.
Sources
Also known as GHSA-56h2-h3h4-m9x6.