CVE-2026-65370: ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. Th

Description

ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk version 0.42.65.

Affected Products

Vendor	Product	Versions
apple	servicetalk	0

References

https://github.com/apple/servicetalk/security/advisories/GHSA-56h2-h3h4-m9x6

Related News (1 articles)

Tier C

VulDB2h ago

CVE-2026-65370 | Apple servicetalk up to 0.42.64 Transfer-Encoding request smuggling

→ No new info (linked only)

CISA KEV❌ No

Actively exploited❌ No

Patch available

0.42.65

PublishedAug 12, 2026

Trending Score20

Source articles1

Independent1

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-65400EXPKEV

CVE-2026-65400: An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS

Trending: 89

CRITICALCVE-2026-64767

CVE-2026-64767: A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma

Trending: 33

CRITICALCVE-2026-43810

CVE-2026-43810: The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15

Trending: 12

CRITICALCVE-2026-64727

CVE-2026-64727: A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Tahoe 26.6, tvOS 26.6.

Trending: 11

CRITICALCVE-2026-43773

CVE-2026-43773: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS So

Trending: 11

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Aug 12, 2026

Discovered by ZDM

Aug 12, 2026

Patch Available

Aug 12, 2026