Loading story…
PortSwigger research warns that ambiguous HTTP/1.1 request boundaries continue to enable HTTP request-smuggling, or desynchronization, attacks across tens of millions of websites. The research introduced new desynchronization classes, reported critical exposure in major CDN infrastructure, and has been associated with compromises of three major CDNs and more than $350,000 in bug-bounty awards despite years of mitigations.
One variant, 0.CL, arises when a front end and back end disagree over a malformed or zero Content-Length header: the front end may forward a request without a body while the back end waits for one. Attackers can exploit an early-response endpoint to cause the back end to consume bytes from a following request, enabling queue poisoning and potentially cross-site scripting against another user. Organizations should eliminate HTTP/1.1 from proxy-to-origin paths where feasible by deploying HTTP/2 or later end to end, and continuously test any remaining HTTP/1.1 intermediaries for parser discrepancies.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A video published by John Hammond featured a discussion with James Kettle about the HTTP/1.1 Must Die research, including the risk posed by HTTP/1.1 request-boundary ambiguity and upstream HTTP/1.1 connections.
HTTP request smuggling was first publicly discovered approximately 21 years before September 2025, establishing the underlying vulnerability class later described as HTTP desynchronization.
A PortSwigger walkthrough demonstrated detecting a 0.CL parser discrepancy using a malformed Content-Length header and converting a confirmed condition into CL.0 queue poisoning. The lab examples showed attacker-controlled responses and victim-side XSS through desynchronized back-end request handling.
James Kettle and collaborating researchers released “HTTP/1.1 Must Die: The Desync Endgame,” introducing two new HTTP desynchronization classes. The research reportedly compromised three major CDNs, exposed critical issues affecting tens of millions of websites, and generated more than $350,000 in bug-bounty payouts.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
portswigger.net
Open sourceportswigger.net
Open sourceportswigger.net
Open sourceportswigger.net
Open sourcehttp1mustdie.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New research and vendor advisories have highlighted a broader class of **HTTP desynchronization and request smuggling** risks driven by parser inconsistencies in headers and chunked encoding. A PortSwigger paper on **CRLF-powered desync attacks** warned that header injection can do far more than trigger open redirects or XSS, enabling attackers to "behead" HTTP streams and create severe front-end/back-end parsing mismatches. Related research on ambiguous chunk line terminators and chunk-extension parsing has shown how subtle differences in HTTP/1.1 handling can be turned into cache poisoning, security-control bypass, unauthorized access, and denial-of-service conditions. Red Hat documented multiple affected implementations under **CWE-444**. **`CVE-2026-33870`** in Netty was rated Important and stems from incorrect parsing of quoted strings in HTTP/1.1 chunked transfer-encoding extension values, with no acceptable mitigation listed beyond product fixes. **`CVE-2024-52304`** in aiohttp affects deployments using the pure Python parser, where newline handling in chunk extensions can let attackers bypass proxies or firewalls. **`CVE-2026-1525`** in Undici allows duplicate `Content-Length` headers through case-variant names, creating malformed requests that can trigger request smuggling or DoS. Supporting tooling such as **smugchunks** has emerged to detect chunk-parsing discrepancies in black-box testing, underscoring that these desync issues are practical and span multiple widely used HTTP stacks.
Aug 20, 2026
PortSwigger Research disclosed an AI-assisted system called **HTTP Terminator** that autonomously generated, tested, and weaponized novel HTTP desynchronization and request smuggling techniques against authorized live targets. The pipeline, published on GitHub as a multi-stage research framework, reportedly produced tens of thousands of candidate vectors from RFC-derived fragments and led to multiple real-world findings, including new desync triggers, a **dual-matching `Content-Length`** desync pattern, a **dangling-byte** weaponization method to improve response queue poisoning, and evidence of a possible new class dubbed **response forking**. The work also uncovered and helped patch **Apache Traffic Server** zero-day **`CVE-2026-63078`**, while exposing exploitable issues involving **F5 Big-IP**, **BeyondTrust Secure Remote Access**, **Citrix NetScaler**, and some **Azure Application Gateway** plus **Akamai** deployments. A related PortSwigger paper detailed **CRLF-powered desync attacks** that turn HTTP header injection in misconfigured **Nginx**, **OpenResty**, and **Tengine** environments into request smuggling, response queue poisoning, browser-powered desync, and even self-propagating desync worms. The researchers said these browser-compatible attacks can enable **XSS**, account takeover, token and cookie theft, and cross-user compromise across sectors including CDN, telecom, payments, retail, streaming, and social platforms. Recommended mitigations included avoiding unsafe use of **`$uri`** or **`$document_uri`** in `proxy_pass` or `return` directives, reviewing upstream proxy configurations, and enabling **HTTP/2 upstream** where possible.
Aug 13, 2026
Researchers disclosed **Underminr**, a CDN abuse technique that allows attackers to conceal malicious connections behind trusted, high-reputation domains hosted on shared content delivery infrastructure. Unlike classic domain fronting, the method relies on a legitimate DNS lookup to an allowed domain that resolves to a shared CDN IP, while the actual connection presents the blocked destination in the TLS `SNI` field and HTTP `Host` header, enabling cross-tenant routing that many defenses fail to detect. ADAMnetworks said it has already observed insider threats using the technique to bypass controls, and warned it could support command-and-control traffic, malware delivery, phishing, data exfiltration, and access to malicious sites. The issue is being described as an architectural weakness rather than a software flaw, with **no CVE and no simple patch**. ADAMnetworks' analysis of nearly **5 million** Tranco-ranked websites across **73 CDN providers** found roughly **42% of domains** and **33 providers** were susceptible, while broader estimates suggested the exposure could extend to **more than 88 million domains** across major platforms including **Cloudflare, Akamai, AWS CloudFront, and Fastly**. Researchers and defenders recommended deep packet inspection, validating `SNI` and `Host` header consistency, monitoring unusual traffic to reputable domains, reviewing CDN tenant isolation, and working with providers; ADAMnetworks also released a lookup tool for domain owners and an open-source monitoring tool called **Outminr**.
Jun 29, 2026