CVE-2025-31958 PUBLISHED

HCL BigFix Service Management (SM) is susceptible to HTTP Request Smuggling

Assigner: HCL
Reserved: 01.04.2025 Published: 21.04.2026 Updated: 21.04.2026

HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 3.7

Product Status

Vendor HCLSoftware
Product BigFix Service Management (SM)
Versions Default: unaffected
  • Version 23 is affected

References

Problem Types

  • CWE-444 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') CWE