THREAT OPS › Threat News › WatsonWebserver v7.1.0 HTTP/1 Chunked Request Processing Bypasses MaxRequestBodySize
WatsonWebserver v7.1.0 HTTP/1 Chunked Request Processing Bypasses MaxRequestBodySize
<p>Posted by Ron E on Aug 26</p>WatsonWebserver contains an HTTP/1 request body size-limit bypass when<br /> processing requests using Transfer-Encoding: chunked.<br /> <br /> The framework's configured Settings.IO.MaxRequestBodySize limit is enforced<br /> when a request declares its body size using Content-Length. However,<br /> requests using chunked transfer encoding are processed through
Original source: https://seclists.org/fulldisclosure/2026/Aug/104