Preliminary research

HTTP/3 in Burp Suite: programmable HTTP/3 testing and race tooling

Tom Stacey · PortSwigger · 23 September 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Introduces HTTP/3 engines and automatic tuning in Turbo Intruder, integrates Single Datagram and QPACK blocked-stream race techniques, and shows downgrade-header testing. An HTTP/3 Adapter extends Burp testing to HTTP/3-only services. Includes configuration tables and request examples.

Record

Researcher

Tom Stacey

Published by

PortSwigger

Date

23 September 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Turbo Intruder
• HTTP/3 Adapter
• Throughput demonstration

Tags

• http3
• race-condition
• request-smuggling
• tooling
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Tom Stacey, first published at the original source. Preserved copies are kept so the citation survives its host.