Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
Summary: PortSwigger researcher James Kettle published a post explaining that request smuggling proofs of concept which only work when connections are reused are usually false positives, since HTTP/1.1 keep-alive and pipelining concatenate requests and responses on the same TCP/TLS socket. He identifies three valid vulnerability classes that do require connection reuse, including connection-locked request smuggling, where front-end servers only reuse the upstream connection if the client connection was reused.
What's compelling: A scanner or tester reporting request smuggling that only reproduces with connection reuse may be flagging your own client's behavior rather than a real desync, so a report needs evidence of impact beyond an attacker making themselves receive a surprising response. Kettle notes connection-locked smuggling can still be used to poison a cache layer, bypass front-end security measures, or reach internal systems through host-header tampering.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026