CVE-2026-77803 Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic
A local attacker can exploit HTTP request desynchronization in Fiddler Classic to split requests and smuggle responses, bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77803?
CVE-2026-77803 is a low-severity vulnerability in Progress® Telerik® Fiddler® Classic, published on 5 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server.
Weakness: CWE-444
Which versions are affected by CVE-2026-77803?
How do I fix CVE-2026-77803?
No fix has been published for CVE-2026-77803 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-77803 being exploited?
There is no known exploitation of CVE-2026-77803 in the wild and no public exploit code.
Sources
Also known as GHSA-xq67-hr2w-mm32.