CVE-2025-55018
An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, For
Severity
Medium 5.2
CVSS 3.1
Exploited
Not listed
EPSS
0.004
30.3th percentile
Discovered by
Vendor
Vendor advisory field
Published
Feb 10, 2026
Assigned by fortinet
Description
An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4.3 through 6.4.16 may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header
Weakness: CWE-444
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiOS | Firewall / NGFW | cna-assigner |
Vendor-reported products (2)
- Fortinet · FortiOS
- Siemens · RUGGEDCOM APE1808
Credit
Discovered by Daobing Li from Fortinet R&D Team
Vendor remediation
Upgrade to FortiOS version 7.6.1 or above Upgrade to FortiOS version 7.4.10 or above