Loading story…
New research and vendor advisories have highlighted a broader class of HTTP desynchronization and request smuggling risks driven by parser inconsistencies in headers and chunked encoding. A PortSwigger paper on CRLF-powered desync attacks warned that header injection can do far more than trigger open redirects or XSS, enabling attackers to "behead" HTTP streams and create severe front-end/back-end parsing mismatches. Related research on ambiguous chunk line terminators and chunk-extension parsing has shown how subtle differences in HTTP/1.1 handling can be turned into cache poisoning, security-control bypass, unauthorized access, and denial-of-service conditions.
Red Hat documented multiple affected implementations under CWE-444. CVE-2026-33870 in Netty was rated Important and stems from incorrect parsing of quoted strings in HTTP/1.1 chunked transfer-encoding extension values, with no acceptable mitigation listed beyond product fixes. CVE-2024-52304 in aiohttp affects deployments using the pure Python parser, where newline handling in chunk extensions can let attackers bypass proxies or firewalls. CVE-2026-1525 in Undici allows duplicate Content-Length headers through case-variant names, creating malformed requests that can trigger request smuggling or DoS. Supporting tooling such as smugchunks has emerged to detect chunk-parsing discrepancies in black-box testing, underscoring that these desync issues are practical and span multiple widely used HTTP stacks.
See affected versions and whether adversaries are exploiting it.
12 events from the most recent confirmed update back to the earliest known activity.
Libevent committed changes to its HTTP subsystem that reject conflicting Transfer-Encoding and Content-Length headers, detect duplicate Content-Length headers, and fail malformed requests with an invalid-header error to prevent request smuggling. The patch also added regression tests covering chunked parsing and Transfer-Encoding validation behavior.
Red Hat listed additional fixes for CVE-2026-33870 in May, including AMQ Broker 7.12.7 and 7.13.5, Apache Camel 4.18.1 for Spring Boot, and Cryostat 4 on RHEL 9.
On April 14 and April 16, Red Hat listed fixes for CVE-2026-33870 in products including Red Hat builds of Quarkus, Apache Camel for Quarkus, and AMQ Broker 7.14.0.
Red Hat published a public vulnerability record for CVE-2026-33870, describing an Important-severity Netty request smuggling flaw caused by incorrect parsing of quoted strings in HTTP/1.1 chunked transfer encoding extension values.
Red Hat made its vulnerability record for CVE-2024-52304 public, documenting an aiohttp request smuggling flaw caused by incorrect parsing of newlines in HTTP chunk extensions.
A Reddit user, t0xodile, posted the PortSwigger paper on r/netsec, amplifying research on CRLF-powered HTTP stream desynchronization attacks.
A PortSwigger paper titled "CRLF-Powered Desync Attacks: Beheading HTTP Streams" described how HTTP header injection via CRLF can enable severe HTTP desynchronization attacks.
Red Hat last modified its CVE-2026-33870 record, updating the public vulnerability entry for the Netty request smuggling issue.
Red Hat Bugzilla documented CVE-2026-1527 in Undici, where attacker-controlled input in the upgrade option of client.request() can inject CRLF sequences, enabling arbitrary HTTP header injection, premature request termination, and possible smuggling to non-HTTP services such as Redis, Memcached, and Elasticsearch. Red Hat said fixes were available for RHEL 8, 9, and 10 through RHSA-2026:7670, RHSA-2026:7350, and RHSA-2026:7675.
Red Hat reported that the Undici issue had been addressed through multiple RHSA advisories affecting RHEL 8, 9, 10, extended update support streams, and Cryostat 4 on RHEL 9.
A Red Hat Bugzilla entry documented CVE-2026-1525 in Undici, where case-variant duplicate Content-Length headers can produce malformed HTTP/1.1 requests leading to denial of service or request smuggling.
Red Hat issued multiple RHSA advisories in late 2024 and early 2025 to fix CVE-2024-52304 across affected Ansible Automation Platform components, including automation-controller, python3.11-aiohttp, and lightspeed-related packages.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
12 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcereddit.com
Open sourcegithub.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourcegithub.com
Open sourcew4ke.info
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PortSwigger Research disclosed an AI-assisted system called **HTTP Terminator** that autonomously generated, tested, and weaponized novel HTTP desynchronization and request smuggling techniques against authorized live targets. The pipeline, published on GitHub as a multi-stage research framework, reportedly produced tens of thousands of candidate vectors from RFC-derived fragments and led to multiple real-world findings, including new desync triggers, a **dual-matching `Content-Length`** desync pattern, a **dangling-byte** weaponization method to improve response queue poisoning, and evidence of a possible new class dubbed **response forking**. The work also uncovered and helped patch **Apache Traffic Server** zero-day **`CVE-2026-63078`**, while exposing exploitable issues involving **F5 Big-IP**, **BeyondTrust Secure Remote Access**, **Citrix NetScaler**, and some **Azure Application Gateway** plus **Akamai** deployments. A related PortSwigger paper detailed **CRLF-powered desync attacks** that turn HTTP header injection in misconfigured **Nginx**, **OpenResty**, and **Tengine** environments into request smuggling, response queue poisoning, browser-powered desync, and even self-propagating desync worms. The researchers said these browser-compatible attacks can enable **XSS**, account takeover, token and cookie theft, and cross-user compromise across sectors including CDN, telecom, payments, retail, streaming, and social platforms. Recommended mitigations included avoiding unsafe use of **`$uri`** or **`$document_uri`** in `proxy_pass` or `return` directives, reviewing upstream proxy configurations, and enabling **HTTP/2 upstream** where possible.
Aug 13, 2026
PortSwigger research warns that ambiguous HTTP/1.1 request boundaries continue to enable HTTP request-smuggling, or desynchronization, attacks across tens of millions of websites. The research introduced new desynchronization classes, reported critical exposure in major CDN infrastructure, and has been associated with compromises of three major CDNs and more than $350,000 in bug-bounty awards despite years of mitigations. One variant, **0.CL**, arises when a front end and back end disagree over a malformed or zero `Content-Length` header: the front end may forward a request without a body while the back end waits for one. Attackers can exploit an early-response endpoint to cause the back end to consume bytes from a following request, enabling queue poisoning and potentially cross-site scripting against another user. Organizations should eliminate HTTP/1.1 from proxy-to-origin paths where feasible by deploying HTTP/2 or later end to end, and continuously test any remaining HTTP/1.1 intermediaries for parser discrepancies.
Sep 3, 2026
Red Hat disclosed and patched three upstream flaws affecting widely used Java networking components in multiple downstream products. **CVE-2026-33871** is an Important-severity denial-of-service issue in Netty HTTP/2 handling that lets a remote attacker flood a server with `CONTINUATION` frames, including zero-byte frames, causing excessive CPU consumption and making the service unresponsive; the bug is mapped to **`CWE-770`**. **CVE-2026-33870** affects Netty's HTTP/1.1 parsing and can enable **HTTP request smuggling** through incorrect handling of quoted strings in chunked transfer-encoding extension values. Both Netty issues were fixed upstream in versions **4.1.132.Final** and **4.2.10.Final**.
Aug 20, 2026