Vulnerability · Published Jan 26, 2026 · Assigned by INCIBE

CVE-2025-41082HTTP Request/Response Smuggling in Altitude Communication Server

Medium 6.9

In plain English

A medium-severity security flaw in Altitude Communication Server from Altitude. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.4%top 62.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Illegal HTTP request traffic vulnerability (CL.0) in Altitude Communication Server, caused by inconsistent analysis of multiple HTTP requests over a single Keep-Alive connection using Content-Length headers. This can cause a desynchronization of requests between frontend and backend servers, which could allow request hiding, cache poisoning or security bypass.

Affected products (as reported)

Vendor	Product	Versions
Altitude	Altitude Communication Server	all versions

Weakness: CWE-444 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-altitude-communication-server