CVE-2024-10264: HTTP Request Smuggling in netease-youdao/qanything

Published Mar 20, 2025

Updated

HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, session hijacking, data leakage, and potentially arbitrary code execution.

Affected Software

2 affected components

NetEase Youdao QAnything=1.4.1

youdao qanything=1.4.1

Event History

Mar 20, 2025

CVE Published

via MITRE·10:10 AM

Data Sourced

via MITRE·10:10 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

May 24, 57551

Event

via NVD·10:12 AM

Frequently Asked Questions

What is the severity of CVE-2024-10264?

CVE-2024-10264 is rated as a high severity vulnerability due to its potential for unauthorized access and session hijacking.

How do I fix CVE-2024-10264?

To fix CVE-2024-10264, upgrade to the patched version of Netease Youdao qanything, as prior versions including 1.4.1 are vulnerable.

What kind of attack can CVE-2024-10264 facilitate?

CVE-2024-10264 can facilitate HTTP request smuggling attacks that allow attackers to bypass security controls and hijack user sessions.

Which version of Netease Youdao qanything is affected by CVE-2024-10264?

CVE-2024-10264 specifically affects Netease Youdao qanything version 1.4.1.

Is CVE-2024-10264 related to web application security?

Yes, CVE-2024-10264 is a web application security vulnerability that exploits inconsistencies in HTTP request handling.