HTTP/1.1 Request Desynchronization Exposes CDN and Origin Infrastructure

PortSwigger research warns that ambiguous HTTP/1.1 request boundaries continue to enable HTTP request-smuggling, or desynchronization, attacks across tens of millions of websites. The research introduced new desynchronization classes, reported critical exposure in major CDN infrastructure, and has been associated with compromises of three major CDNs and more than $350,000 in bug-bounty awards despite years of mitigations.

One variant, 0.CL, arises when a front end and back end disagree over a malformed or zero Content-Length header: the front end may forward a request without a body while the back end waits for one. Attackers can exploit an early-response endpoint to cause the back end to consume bytes from a following request, enabling queue poisoning and potentially cross-site scripting against another user. Organizations should eliminate HTTP/1.1 from proxy-to-origin paths where feasible by deploying HTTP/2 or later end to end, and continuously test any remaining HTTP/1.1 intermediaries for parser discrepancies.