Read the docs
TI-2023-16903 Aliases CVE-2023-34037GHSA-329g-wg5g-524r

VMware Horizon Server contains a HTTP request smuggling vulnerability.

Priority LOW 24CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00465 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware Horizon ServerHorizon Server 2306, Horizon Server 2303, Horizon Server 2212, Horizon Server 2209, Horizon Server 2206, Horizon Server 2111.x, Horizon Server 2106, Horizon Server 2103, Horizon Server 2012, Horizon Server 2006—No fix listedCNA
  • VMware Horizon Server Vendor— Affected Horizon Server 2306, Horizon Server 2303, Horizon Server 2212, Horizon Server 2209, Horizon Server 2206, Horizon Server 2111.x, Horizon Server 2106, Horizon Server 2103, Horizon Server 2012, Horizon Server 2006 Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:vmware:horizon_client:2006:*:*:*:*:*:*:*2006VulnerableVMware
cpe:2.3:a:vmware:horizon_client:2012:*:*:*:*:*:*:*2012VulnerableVMware
cpe:2.3:a:vmware:horizon_client:2103:*:*:*:*:*:*:*2103VulnerableVMware
cpe:2.3:a:vmware:horizon_client:2106:*:*:*:*:*:*:*2106VulnerableVMware
cpe:2.3:a:vmware:horizon_client:2111:*:*:*:*:*:*:*2111VulnerableVMware
cpe:2.3:a:vmware:horizon_client:2111.1:*:*:*:*:*:*:*2111.1VulnerableVMware
cpe:2.3:a:vmware:horizon_client:2203:*:*:*:*:*:*:*2203VulnerableVMware
cpe:2.3:a:vmware:horizon_client:2212:*:*:*:*:*:*:*2212VulnerableVMware
  • cpe:2.3:a:vmware:horizon_client:2006:*:*:*:*:*:*:* Versions 2006 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_client:2012:*:*:*:*:*:*:* Versions 2012 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_client:2103:*:*:*:*:*:*:* Versions 2103 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_client:2106:*:*:*:*:*:*:* Versions 2106 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_client:2111:*:*:*:*:*:*:* Versions 2111 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_client:2111.1:*:*:*:*:*:*:* Versions 2111.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_client:2203:*:*:*:*:*:*:* Versions 2203 Vulnerable ·VMware
  • cpe:2.3:a:vmware:horizon_client:2212:*:*:*:*:*:*:* Versions 2212 Vulnerable ·VMware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-34037
  2. 2026-10-03 Alias added: GHSA-329g-wg5g-524r

References

Advisory 1

  • TI-2020-03448 Improper privilege management in VMware Fusion, VMware Remote Console for Mac and Horizon… KEVCVSS 3.1HIGH 7.8
  • TI-2020-03472 VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior before… CVSS 3.1HIGH 7.8
  • TI-2020-03459 Incorrect permission assignment in VMware Horizon Client for Windows CVSS 3.1HIGH 7.8
  • TI-2019-03948 Incorrect permission assignment in VMware Horizon Client for Windows CVSS 3.1HIGH 7.8
  • TI-2018-05086 VMware Horizon Client for Linux (4.x before 4.8.0 and prior) contains a local privilege… CVSS 3.0HIGH 7.8
  • TI-2018-05092 Out-of-bounds read in VMware Horizon 6, Horizon 7, and Horizon Client CVSS 3.0MEDIUM 6.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences