HTTP/3 in Burp Suite - it’s time to find a bigger wordlist

Summary: PortSwigger researcher @t0xodile released HTTP/3 support for Turbo Intruder, which exceeded 100,000 requests per second over Wi-Fi from a laptop and reached roughly 180,000 RPS when run from a cloud box in the target's region, up from 30,000 RPS over HTTP/1.1 in the earlier Billion Request Attack work. A new HTTP/3 Adapter plugin converts Burp Suite traffic from HTTP/1.1 or HTTP/2 to HTTP/3, and the HTTP3 engine adds two race techniques, the Single Datagram Attack and QPACK Blocked Streams, alongside a new AUTO engine that selects the highest available HTTP version and tunes settings during an attack.
What's compelling: Sites that only speak HTTP/3 were previously unreachable through Burp's tooling, and the new engine's race techniques target smaller race windows than the Single-Packet attack, so a TOCTOU flaw your team dismissed as too narrow to hit may now be practical.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026