CRLF-Powered Desync Scanner
Summary: PortSwigger released a Burp extension called CRLF-Powered Desync Scanner, version 1.0.0, authored by Tom Stacey, which detects HTTP request and response header injection vulnerabilities that arise when a front-end proxy forwards CRLF sequences into the request line or headers. The scanner is the research tool behind the presentation "CRLF-Powered Desync Attacks: Beheading HTTP Streams" and was last updated on 05 August 2026.
Key Takeaway: The flaw it hunts lets an attacker inject their own headers, split requests, or desynchronize the connection - and it only exists because a front-end proxy passes CRLF sequences through, so the exposure sits in your edge infrastructure, not in the application code your teams own.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026