Other nomination

HTTP/1.1 must die: the desync endgame

James Kettle · PortSwigger Research · 6 August 2025

New classes of HTTP desync against upstream HTTP/1.1: detecting parser discrepancies with masked headers, making zero-length desyncs exploitable through early-response gadgets and a double-desync that converts them, and desyncs triggered by the Expect header. An attacker poisons a shared front-end connection to hijack other users' requests and take over sites behind major CDNs.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

6 August 2025

In the archive

• Nominated for the 2025 Top 10 Web Hacking Techniques

Related sources

• Research summary and FAQ
• Talk slides
• HTTP Request Smuggler 3.0
• Turbo Intruder offset-discovery script
• Talk recording
• Talk recording
• Talk recording

Tags

• desync
• request-smuggling
• http
• proxy
• cdn
• cache-poisoning
• http2
• tooling
• bug-bounty

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host.