fyyre/cve-2026-88773Python proof-of-concept exploiting a 32-bit chunk-size accumulator wrap in NetScaler nsppe's HTTP/1.1 chunked parser to trigger request smuggling.
Proof-of-concept for an HTTP request-smuggling issue in the NetScaler nsppe HTTP/1.1 chunked-body parser.
A nine-digit chunk-size value (100000005) is accumulated into a 32-bit register with no overflow check, silently wrapping to 5.
The proxy forwards the original framing but uses the wrapped size to decide where the request ends.
A correct backend computing the full 64-bit length and a proxy that has already finished the request now disagree about message boundaries.
python3 88773.py <host> [--port 443] [--sni poc] [--plain] [--flow {a,b,both}] [--timeout 5] [-v]
No authentication is required. The only precondition is reachability of an HTTP virtual server on the appliance.
The script first sends a chunked POST and a pair of pipelined GETs. These establish that the target relays both single and multi-request traffic before the smuggle payload is attempted. These folks did the detailed research. I highly suggest you read it -> https://github.com/Scyrix-LLC/CVE-2026-88773
This is a research proof-of-concept. It does not include weaponization (sorry!)