THREATOPS
THREAT OPSThreat News › WatsonWebserver v7.1.0 HTTP/1 Chunked Request Processing Bypasses MaxRequestBodySize

WatsonWebserver v7.1.0 HTTP/1 Chunked Request Processing Bypasses MaxRequestBodySize

lowfulldisclosurePublished 2026-08-26

<p>Posted by Ron E on Aug 26</p>WatsonWebserver contains an HTTP/1 request body size-limit bypass when<br /> processing requests using Transfer-Encoding: chunked.<br /> <br /> The framework&apos;s configured Settings.IO.MaxRequestBodySize limit is enforced<br /> when a request declares its body size using Content-Length. However,<br /> requests using chunked transfer encoding are processed through

Original source: https://seclists.org/fulldisclosure/2026/Aug/104