CVE-2024-10264— HTTP Request Smuggling in netease-youdao/qanything
Quick assessment
Affected
netease-youdao netease-youdao/qanything
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NetEase QAnything是中国网易（NetEase）公司的致力于支持任意格式文件或数据库的本地知识库问答系统，可断网安装使用。 NetEase QAnything 1.4.1版本存在环境问题漏洞，该漏洞源于HTTP请求走私，可能导致未经授权的访问和任意代码执行。
Possible ATT&CK Techniques 2 AI
T1071 · Application Layer Protocol T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-10264
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HTTP Request Smuggling in netease-youdao/qanything
Source: CVE Program / CVE List V5
Vulnerability Description
HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, session hijacking, data leakage, and potentially arbitrary code execution.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5
Vulnerability Title
NetEase QAnything 环境问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NetEase QAnything是中国网易（NetEase）公司的致力于支持任意格式文件或数据库的本地知识库问答系统，可断网安装使用。 NetEase QAnything 1.4.1版本存在环境问题漏洞，该漏洞源于HTTP请求走私，可能导致未经授权的访问和任意代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| netease-youdao | netease-youdao/qanything | unspecified ~ latest | - |
|
II. Public POCs for CVE-2024-10264
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-10264
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-10264 (1)
Same Patch Batch · netease-youdao · 2025-03-20 · 6 CVEs total
| CVE-2024-12866 | Local File Inclusion in netease-youdao/qanything | |
| CVE-2024-12864 | Unauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qa | |
| CVE-2024-8024 | CORS Misconfiguration in netease-youdao/qanything | |
| CVE-2024-8027 | Stored Cross-Site Scripting (XSS) in netease-youdao/QAnything | |
| CVE-2024-8026 | CSRF due to overly permissive CORS headers in netease-youdao/qanything |
IV. Related Vulnerabilities
Same product: netease-youdao/qanything
-
CVE-2024-12866
Local File Inclusion in netease-youdao/qanything -
CVE-2024-8026
CSRF due to overly permissive CORS headers in netease-youdao -
CVE-2024-12864
Unauthenticated DoS by Sending Large Filename at File Upload -
CVE-2024-8027
Stored Cross-Site Scripting (XSS) in netease-youdao/QAnythin -
CVE-2024-8024
CORS Misconfiguration in netease-youdao/qanything
Same vendor: netease-youdao
-
CVE-2026-18995
netease-youdao LobsterAI MEDIA Path artifactParser.ts parseM -
CVE-2024-12866
Local File Inclusion in netease-youdao/qanything -
CVE-2024-8026
CSRF due to overly permissive CORS headers in netease-youdao -
CVE-2024-12864
Unauthenticated DoS by Sending Large Filename at File Upload -
CVE-2024-8027
Stored Cross-Site Scripting (XSS) in netease-youdao/QAnythin
Same weakness: CWE-444
-
CVE-2026-75922
Reverse::Proxy versions before 0.04 for Perl allow HTTP requ -
CVE-2026-63385
Libevent: HTTP header handling bugs create risk of access co -
CVE-2026-63379
Libevent: HTTP Header smuggling -
CVE-2026-63382
libevent evhttp: Multiple HTTP Parser Bugs Enable Request Sm -
CVE-2026-73256
Mongoose: HTTP/1.0 detection off-by-one enables request smug
V. Comments for CVE-2024-10264
No comments yet