HTTP/1.1 Must Die: What This Means for App Sec Leadership
Summary: At Black Hat USA and DEFCON 2025, PortSwigger Director of Research James Kettle presented research arguing that HTTP request smuggling, or desync attacks, remains a systemic protocol-level threat affecting tens of millions of websites, and that patching individual implementations will never eliminate it. The research team earned over $200,000 in bug bounties in two weeks from these techniques, finding several major CDNs vulnerable in ways that could affect all 24 million of their customers' web infrastructure.
Bottom line: Kettle's argument is that the flaw sits in HTTP/1.1's design, not in any one vendor's code, so systems protected by major CDNs and WAFs were still exploitable and the $200,000 in two weeks shows how quickly that pays off for attackers. If your architecture quietly downgrades HTTP/2 to HTTP/1.1 behind the scenes, the parsing ambiguity that enables session hijacking, cache poisoning, and data leaks is still present regardless of how many smuggling bugs you have patched.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026