CVE-2025-12811 (GCVE-0-2025-12811)

Vulnerability from cvelistv5 – Published: 2026-02-18 22:08 – Updated: 2026-02-19 16:04
VLAI?
Title
Cloud Suite and Privilege Access Service– HTTP request smuggling vulnerability
Summary
Improper Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Delinea Inc. Cloud Suite and Privileged Access Service. If you're not using the latest Server Suite agents, this fix requires that you upgrade to Server Suite 2023.1 (agent 6.0.1) or later. * If you cannot upgrade to Release 2023.1 (agent version 6.0.1) or later, you can choose one of the following versions: * Server Suite release 2023.0.5 (agent version 6.0.0-158) * Server Suite release 2022.1.10 (agent version 5.9.1-337)
Severity ?
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
Impacted products
Vendor Product Version
Delinea Inc. Cloud Suite and Privileged Access Service Unaffected: 25.1 HF5
Affected: 25.1 HF4 and earlier
Create a notification for this product.
Credits
Dawid Dudek
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12811",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-19T16:02:55.787935Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-19T16:04:19.494Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Cloud Suite and Privileged Access Service",
          "vendor": "Delinea Inc.",
          "versions": [
            {
              "status": "unaffected",
              "version": "25.1 HF5"
            },
            {
              "status": "affected",
              "version": "25.1 HF4 and earlier"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Dawid Dudek"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Inconsistent Interpretation of\nHTTP Requests (\u0027HTTP Request Smuggling\u0027) in Delinea Inc. Cloud Suite and\nPrivileged Access Service.\u003cbr\u003e\u003cbr\u003eIf you\u0027re not using the latest Server Suite agents, this fix \u003cb\u003erequires that you upgrade\u0026nbsp;\u003c/b\u003eto Server Suite 2023.1 (agent 6.0.1) or later.\u003cul\u003e\u003cli\u003e\u003cp\u003eIf you cannot upgrade to Release 2023.1 (agent version 6.0.1) or later, you can choose one of the following versions:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eServer Suite release 2023.0.5 (agent version 6.0.0-158)\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eServer Suite release 2022.1.10 (agent version 5.9.1-337)\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\n\n\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "Improper Inconsistent Interpretation of\nHTTP Requests (\u0027HTTP Request Smuggling\u0027) in Delinea Inc. Cloud Suite and\nPrivileged Access Service.\n\nIf you\u0027re not using the latest Server Suite agents, this fix requires that you upgrade\u00a0to Server Suite 2023.1 (agent 6.0.1) or later.  *  If you cannot upgrade to Release 2023.1 (agent version 6.0.1) or later, you can choose one of the following versions:\n\n  *  Server Suite release 2023.0.5 (agent version 6.0.0-158)\n\n\n  *  Server Suite release 2022.1.10 (agent version 5.9.1-337)"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-18T22:23:56.385Z",
        "orgId": "1443cd92-d354-46d2-9290-d812316ca43a",
        "shortName": "Delinea"
      },
      "references": [
        {
          "url": "https://trust.delinea.com/?tcuUid=d512dd6a-fa40-421c-ac11-1be280b1cb83"
        },
        {
          "url": "https://docs.delinea.com/online-help/cloud-suite/release-notes/cloud-suite/25.1.htm#Resolved2"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Cloud Suite and Privilege Access Service\u2013 HTTP request smuggling vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1443cd92-d354-46d2-9290-d812316ca43a",
    "assignerShortName": "Delinea",
    "cveId": "CVE-2025-12811",
    "datePublished": "2026-02-18T22:08:25.254Z",
    "dateReserved": "2025-11-06T16:31:44.269Z",
    "dateUpdated": "2026-02-19T16:04:19.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-12811\",\"sourceIdentifier\":\"1443cd92-d354-46d2-9290-d812316ca43a\",\"published\":\"2026-02-18T23:16:18.580\",\"lastModified\":\"2026-02-19T15:53:02.850\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Inconsistent Interpretation of\\nHTTP Requests (\u0027HTTP Request Smuggling\u0027) in Delinea Inc. Cloud Suite and\\nPrivileged Access Service.\\n\\nIf you\u0027re not using the latest Server Suite agents, this fix requires that you upgrade\u00a0to Server Suite 2023.1 (agent 6.0.1) or later.  *  If you cannot upgrade to Release 2023.1 (agent version 6.0.1) or later, you can choose one of the following versions:\\n\\n  *  Server Suite release 2023.0.5 (agent version 6.0.0-158)\\n\\n\\n  *  Server Suite release 2022.1.10 (agent version 5.9.1-337)\"},{\"lang\":\"es\",\"value\":\"Interpretaci\u00f3n Inconsistente e Indebida de Solicitudes HTTP (\u0027Contrabando de Solicitudes HTTP\u0027) en Delinea Inc. Cloud Suite y Privileged Access Service.\\n\\nSi usted no est\u00e1 utilizando los agentes m\u00e1s recientes de Server Suite, esta correcci\u00f3n requiere que actualice a Server Suite 2023.1 (agente 6.0.1) o posterior. * Si no puede actualizar a la versi\u00f3n 2023.1 (versi\u00f3n de agente 6.0.1) o posterior, puede elegir una de las siguientes versiones:\\n\\n* Server Suite versi\u00f3n 2023.0.5 (versi\u00f3n de agente 6.0.0-158)\\n\\n* Server Suite versi\u00f3n 2022.1.10 (versi\u00f3n de agente 5.9.1-337)\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"1443cd92-d354-46d2-9290-d812316ca43a\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"1443cd92-d354-46d2-9290-d812316ca43a\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-444\"}]}],\"references\":[{\"url\":\"https://docs.delinea.com/online-help/cloud-suite/release-notes/cloud-suite/25.1.htm#Resolved2\",\"source\":\"1443cd92-d354-46d2-9290-d812316ca43a\"},{\"url\":\"https://trust.delinea.com/?tcuUid=d512dd6a-fa40-421c-ac11-1be280b1cb83\",\"source\":\"1443cd92-d354-46d2-9290-d812316ca43a\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-12811\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-19T16:02:55.787935Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-19T16:03:15.275Z\"}}], \"cna\": {\"title\": \"Cloud Suite and Privilege Access Service\\u2013 HTTP request smuggling vulnerability\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Dawid Dudek\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 6.9, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Delinea Inc.\", \"product\": \"Cloud Suite and Privileged Access Service\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"25.1 HF5\"}, {\"status\": \"affected\", \"version\": \"25.1 HF4 and earlier\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://trust.delinea.com/?tcuUid=d512dd6a-fa40-421c-ac11-1be280b1cb83\"}, {\"url\": \"https://docs.delinea.com/online-help/cloud-suite/release-notes/cloud-suite/25.1.htm#Resolved2\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Inconsistent Interpretation of\\nHTTP Requests (\u0027HTTP Request Smuggling\u0027) in Delinea Inc. Cloud Suite and\\nPrivileged Access Service.\\n\\nIf you\u0027re not using the latest Server Suite agents, this fix requires that you upgrade\\u00a0to Server Suite 2023.1 (agent 6.0.1) or later.  *  If you cannot upgrade to Release 2023.1 (agent version 6.0.1) or later, you can choose one of the following versions:\\n\\n  *  Server Suite release 2023.0.5 (agent version 6.0.0-158)\\n\\n\\n  *  Server Suite release 2022.1.10 (agent version 5.9.1-337)\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper Inconsistent Interpretation of\\nHTTP Requests (\u0027HTTP Request Smuggling\u0027) in Delinea Inc. Cloud Suite and\\nPrivileged Access Service.\u003cbr\u003e\u003cbr\u003eIf you\u0027re not using the latest Server Suite agents, this fix \u003cb\u003erequires that you upgrade\u0026nbsp;\u003c/b\u003eto Server Suite 2023.1 (agent 6.0.1) or later.\u003cul\u003e\u003cli\u003e\u003cp\u003eIf you cannot upgrade to Release 2023.1 (agent version 6.0.1) or later, you can choose one of the following versions:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eServer Suite release 2023.0.5 (agent version 6.0.0-158)\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eServer Suite release 2022.1.10 (agent version 5.9.1-337)\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\\n\\n\\n\\n\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-444\", \"description\": \"CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"1443cd92-d354-46d2-9290-d812316ca43a\", \"shortName\": \"Delinea\", \"dateUpdated\": \"2026-02-18T22:23:56.385Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-12811\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-19T16:04:19.494Z\", \"dateReserved\": \"2025-11-06T16:31:44.269Z\", \"assignerOrgId\": \"1443cd92-d354-46d2-9290-d812316ca43a\", \"datePublished\": \"2026-02-18T22:08:25.254Z\", \"assignerShortName\": \"Delinea\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.