You're seeing this page because you followed a link on a cert.org webpage about so-called vulnerabilities in Hiawatha found by Keysight. Here you can read the truth about those claims.
Request smuggling: Yes, there was an issue that allowed request smuggling. When you configured a reverse proxy in Hiawatha. Hiawatha would then forward requests to a pre-configured other webserver. An attacker could then send requests to other websites on that same 'other webserver'. That's it, nothing more. No user sessions hijack and no malicious payloads injections. The reverse proxy was originally implemented for users who wanted to host web applications that only speak HTTP instead of CGI. For such usage, all requests will end up at the same web application, giving you nothing extra. In most professional situations, a webserver hosts a single web application. So, in those cases, smuggling requests will also give you nothing extra. Worth a CVE? Sure, but not with the given score.
Timing issue in Tomahawk: An attacker needs a local account to try to exploit this. Because it's all done locally, the application that tries to exploit this, causes CPU load which affects the timing attack, making it very hard to exploit. Keysight already admitted to me they couldn't do it and that it's unlikely that it's even possible. And with a local account, an attacker can do many other things that are far more dangerous than this. So, to me, not worth a CVE.
Double free in show_index(): The double free occurs when a specific malloc() fails. A malloc() usually fails when the system is out of memory. To create that situation, you have to send a lot of simultaneous requests. Since Hiawatha has a default maximum size for the request a client is allowed to send, you need a lot of concurrent connections. Since Hiawatha has a default maximum connections per client, you also need a lot of clients. And even if you have all that, there is a next challenge. There are many malloc()s before the specific malloc() that needs to fail. It's very likely that one of those will fail when the system is out of memory, causing Hiawatha to drop the connection. So, the specific malloc() will very likely never be reached. And even if that happens, that specific connection will be dropped, so you need to know which of the many other connections is the right one to mess with the unallocated memory. So, this bug is nearly impossible to exploit and therefore not worth a CVE.
I talked to Keysight about this, but they didn't care. After several e-mails, they gave me the impression that all they wanted was having as many CVEs in their name as possible. So, I stopped talking to them. I informed cert.org about what was wrong with Keysight's claims, but they also didn't really care. They just blindly published what was sent to them.