Medium severity · published Jan 26, 2026
CVE-2025-57783
Improper header parsing may lead to request smuggling
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
Improper header parsing may lead to request smuggling has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to access restricted resources managed by Hiawatha webserver.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HW
Hiawatha Web server · Hiawatha
11.7 through 8.5 · source: vendor
HI
Hiawatha · Hiawatha-webserver
11.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-57783
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-57783
Product
https://gitlab.com/hsleisink/hiawatha/-/blame/master/src/http.c?ref_type=heads#L205
More from Hiawatha Web server
6.5
CVE-2025-57785
Double free in XSLT in 'show_index'
3.3
CVE-2025-57784
Tomahawk authentication timing attack due to usage of 'strcmp'