Typical severity: High. Likelihood of attack: Medium. An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server). See CanPrecede relationships for possible consequences.
Design: evaluate HTTP agents prior to deployment for parsing/interpretation discrepancies. | Configuration: front-end HTTP agents notice ambiguous requests. | Configuration: back-end HTTP agents reject ambiguous requests and close the network connection. | Configuration: Disable reuse of back-end connections. | Configuration: Use HTTP/2 for back-end connections.