CVE-2025-55018

An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-25-667	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios::::::::
	cpe:2.3:o:fortinet:fortios:7.6.0:::::::*

History

No history.

Information

Published : 2026-02-10 16:16

Updated : 2026-02-23 14:02

NVD link : CVE-2025-55018

Mitre link : CVE-2025-55018

CVE.ORG link : CVE-2025-55018

JSON object : View

Products Affected

fortinet

fortios

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2025-55018", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@fortinet.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2026-02-10T16:16:08.913", "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-667", "tags": ["Vendor Advisory"], "source": "psirt@fortinet.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "psirt@fortinet.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header"}, {"lang": "es", "value": "Una vulnerabilidad de interpretaci\u00f3n inconsistente de solicitudes HTTP ('contrabando de solicitudes HTTP') en Fortinet FortiOS 7.6.0, FortiOS 7.4.0 hasta 7.4.9, FortiOS 7.2 todas las versiones, FortiOS 7.0 todas las versiones, FortiOS 6.4.3 hasta 6.4.16 puede permitir a un atacante no autenticado contrabandear una solicitud HTTP no registrada a trav\u00e9s de las pol\u00edticas del cortafuegos mediante un encabezado especialmente dise\u00f1ado."}], "lastModified": "2026-02-23T14:02:30.417", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B52F326A-281A-437B-84A4-1F443D29EC49", "versionEndIncluding": "6.4.16", "versionStartIncluding": "6.4.3"}, {"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D217AE6C-1631-4E3E-95D8-7D13F299B4DA", "versionEndExcluding": "7.4.10", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44CE8EE3-D64A-49C8-87D7-C18B302F864A"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@fortinet.com"}