CVE-2026-48135: HTTP service can incorrectly process malformed HTTP requests

Medium severity · published May 26, 2026

CVE-2026-48135

HTTP service can incorrectly process malformed HTTP requests

5.3

CVSS

2.6%

EPSS

On KEV

Description

A Check Point HTTP-based service can incorrectly handle malformed HTTP requests. The issue is related to HTTP request parsing and validation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.6% · higher than 85% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Quantum Security Gateway · Check Point

R82.10 with Jumbo Hotfix Take 6 or below; R82 with Jumbo Hotfix Take 91 or below; R81.20 with Jumbo Hotfix Take 127 or below; All releases from R81.10 and below · source: vendor

Affected product

Quantum Security Gateway

Check Point

All Quantum Security Gateway CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-48135

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-48135

support.checkpoint.com

https://support.checkpoint.com/results/sk/sk184991