Loading story…
Security researchers detailed a series of techniques that make web race conditions easier to trigger and more practical to exploit against real applications. PortSwigger's work showed that race conditions extend beyond simple limit-overrun bugs into broader application state-machine flaws, where carefully timed parallel requests can bypass business-logic checks and force inconsistent server behavior. A follow-on technique, the single-packet attack, reduced network jitter by coalescing multiple requests so they arrive together, effectively making remote race-condition testing behave more like a local attack and improving reliability against web targets.
Flatt Security later expanded that approach with First Sequence Sync, a method that combines IP fragmentation and deliberate TCP sequence-number reordering to overcome the single-packet attack's approximate 65,535-byte constraint. In testing, the technique synchronized much larger batches of requests over one HTTP/2 connection, reportedly sending 10,000 requests in about 166 ms and demonstrating a bypass of a one-time-token rate limit by making 1,000 authentication attempts despite a nominal cap of five. The research indicates that exploitability depends on implementation details such as TCP receive-buffer capacity and HTTP/2 SETTINGS_MAX_CONCURRENT_STREAMS, but collectively the findings show that modern packet-level synchronization can significantly increase the impact and repeatability of web race-condition attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The research demonstrated bypassing a one-time-token authentication rate limit by making 1,000 attempts despite a nominal server-side limit of five. The author contrasted this with only about 10 attempts achieved against the same target using last-byte sync.
In the published research, the author reported a benchmark sending 10,000 requests in about 166 ms in a test environment using AWS EC2 instances. The demonstration showed the technique could support far more simultaneous requests than prior approaches.
On August 2, 2024, RyotaK of Flatt Security published research describing "First Sequence Sync," a race-condition exploitation method that combines IP fragmentation with TCP sequence-number reordering to synchronize many large requests over a single HTTP/2 connection. The article says the technique extends the practical limits of the earlier single-packet attack.
PortSwigger Research published "The single-packet attack: making remote race-conditions 'local'," presenting the single-packet attack for synchronizing requests in race-condition exploitation. Later research cited this technique as the foundation for further expansion.
PortSwigger Research published "Smashing the state machine: the true potential of web race conditions," documenting techniques for exploiting web race conditions. This established prior research that later work explicitly built upon.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
flatt.tech
Open sourceportswigger.net
Open sourceportswigger.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PortSwigger Research disclosed an AI-assisted system called **HTTP Terminator** that autonomously generated, tested, and weaponized novel HTTP desynchronization and request smuggling techniques against authorized live targets. The pipeline, published on GitHub as a multi-stage research framework, reportedly produced tens of thousands of candidate vectors from RFC-derived fragments and led to multiple real-world findings, including new desync triggers, a **dual-matching `Content-Length`** desync pattern, a **dangling-byte** weaponization method to improve response queue poisoning, and evidence of a possible new class dubbed **response forking**. The work also uncovered and helped patch **Apache Traffic Server** zero-day **`CVE-2026-63078`**, while exposing exploitable issues involving **F5 Big-IP**, **BeyondTrust Secure Remote Access**, **Citrix NetScaler**, and some **Azure Application Gateway** plus **Akamai** deployments. A related PortSwigger paper detailed **CRLF-powered desync attacks** that turn HTTP header injection in misconfigured **Nginx**, **OpenResty**, and **Tengine** environments into request smuggling, response queue poisoning, browser-powered desync, and even self-propagating desync worms. The researchers said these browser-compatible attacks can enable **XSS**, account takeover, token and cookie theft, and cross-user compromise across sectors including CDN, telecom, payments, retail, streaming, and social platforms. Recommended mitigations included avoiding unsafe use of **`$uri`** or **`$document_uri`** in `proxy_pass` or `return` directives, reviewing upstream proxy configurations, and enabling **HTTP/2 upstream** where possible.
Aug 7, 2026
A newly disclosed denial-of-service flaw in multiple HTTP/2 server implementations allows remote, unauthenticated attackers to exhaust memory and crash services by abusing normal flow-control behavior. By stalling outbound data transmission—such as by manipulating `SETTINGS_INITIAL_WINDOW_SIZE` or withholding `WINDOW_UPDATE` frames—an attacker can cause vulnerable servers to keep generating and buffering full responses, leading to out-of-memory conditions, swap thrashing, worker-thread exhaustion, service freezes, or kernel OOM kills. CERT/CC is tracking the issue after it was reported by the Okta Red Team, and the coordinated disclosures include `CVE-2026-44909`, `CVE-2026-59173`, and `CVE-2026-59762`. Affected vendors named in advisories include Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, and Yahoo. Apache Traffic Server users were advised to upgrade to versions `9.1.14` or `10.1.3`, while F5 published guidance for BIG-IP and other vendors issued product-specific fixes or mitigations. Recommended defenses include stricter memory limits, limiting concurrent HTTP/2 streams, terminating stalled connections, and improving timeout and backpressure handling. No public exploitation has been confirmed, but the low complexity of the attack has prompted calls for rapid patching and configuration hardening.
Jul 24, 2026
Netty published a broad set of security advisories covering **22 vulnerabilities** across its networking stack, with impacts ranging from remote denial of service to trust-boundary failures. The issues affect multiple modules and protocols, including **HTTP/2, HTTP/3, QUIC, DNS, Redis, SCTP, Unix domain sockets, HAProxy PROXY protocol v2, and TLS handling**. Reported consequences include uncontrolled memory allocation, `ByteBuf` and file descriptor leaks, failure to enforce HTTP/2 stream limits, DNS cache poisoning, improper TLS hostname validation, IPv6 subnet access-control bypass, request smuggling, and QUIC reflection or stateless reset abuse. One of the most serious flaws, **`CVE-2026-45416`**, allows a remote attacker to send as little as **nine bytes** in a crafted TLS `ClientHello` and trigger roughly **16 MiB** of unpooled direct-memory allocation per connection in Netty's SNI handling path. Because the buffer can remain allocated until the connection closes, repeated connections can exhaust direct memory and disrupt services. The flaw affects **Netty 4.1.x before `4.1.135.Final`** and **4.2.0.Final through `4.2.14.Final`**, and was fixed in **`4.1.135.Final`** and **`4.2.15.Final`**; the wider advisory set was published through Netty's GitHub security advisories and highlights the risk to Java applications that embed Netty as a dependency.
Jul 10, 2026