HTTP/1.1 Must Die: Conquering the 0.CL Challenge
Summary: PortSwigger guest researcher Julen Garrido Estévez published a walkthrough of the 0.CL HTTP request smuggling technique, in which a front-end reads "Content-Length: 0" while the back-end parses the following bytes differently, letting one request absorb bytes from the next. The write-up builds four proofs of concept across two approaches - ignoring front-end-injected headers or calculating their byte offset - and converts the 0.CL condition into CL.0 to poison the back-end queue, using an early-response gadget such as a static file to break the timeout deadlock.
Bottom line: The attack hinges on a single parsing disagreement - a space before a colon in Content-Length was enough to desynchronize front-end and back-end in the lab - and once the queue is poisoned, the next legitimate visitor's request carries the attacker's payload, in this case an XSS that fires alert().
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026