CVE-2024-10264 is a critical HTTP request smuggling flaw (CVSS 9.8) in netease-youdao QAnything 1.4.1. A proxy and the server can read the same request differently, which can bypass security controls and lead to unauthorized access. No fixed version is confirmed, so check the project and review your proxy setup.
What's affected
The CVE record lists netease-youdao/qanything version 1.4.1. The description says the flaw arises from inconsistencies in how a proxy and a server interpret HTTP requests, and lists possible effects: unauthorized access, bypassing security controls, session hijacking, data leakage and potentially arbitrary code execution. The reference is a huntr bounty page that I could not read, since it loads its content with scripts.
I could not confirm a fixed version from the sources available, so check the vendor site and release notes for a newer release.
How to check if you're exposed
Find the QAnything version in your deployment, whether it is a container tag or a git checkout. Compare it with 1.4.1, and look at the project's releases for newer versions.
Then look at your architecture. Request smuggling needs two HTTP parsers in a chain, such as a reverse proxy in front of an application server. Draw the chain in your deployment: load balancer, proxy, application. Note the software and version at each hop, since the gaps between their parsers are the issue.
An API security scan of the exposed endpoints can show how your gateways handle malformed or ambiguous requests, without needing any exploit code.
What to do now
- Find QAnything deployments and their versions.
- Check the project for a release after 1.4.1 and plan the update.
- Update the proxy and web server software in front of it, and prefer HTTP/2 end to end where your stack supports it.
- Configure the proxy to reject ambiguous requests, such as those with conflicting length and encoding headers.
- Do not rely on the proxy alone for access control. Check authorization inside the application too.
Why it matters
HTTP request smuggling (CWE-444) exploits disagreement between two systems about where one request ends and the next begins. A front end proxy might see one request, while the back end sees two. The extra request can reach the back end with the trust that the proxy would normally add or check, which is how access controls get bypassed.
The list of impacts in the record is long and general. It may be worth reading that as the range of what request smuggling can do in any system, not as proof that each outcome applies to your deployment. QAnything is a question answering system built on your own documents, so access to it can mean access to those documents. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is the proxy part of the problem?
Request smuggling needs two parsers. The flaw lives in how they disagree, so both the application and the proxy settings matter.
Is a fix confirmed?
I could not confirm one. Check the project releases and the huntr report.
Sources
Last reviewed: 19 October 2026.
