HTTP/1.1 Must Die: What This Means for In-House Pentesters
Summary: At Black Hat USA and DEFCON 2025, PortSwigger Director of Research James Kettle presented research arguing that HTTP request smuggling, or desync attacks, remains prevalent and compromises tens of millions of websites. The research found several major CDNs vulnerable to new desync vectors, exposing over 24 million customer websites, and the techniques earned researchers over $200,000 in bug bounties after bypassing existing mitigations.
Key Takeaway: Kettle's conclusion is that patching individual implementations will never eliminate the threat and that the only real fix is retiring HTTP/1.1, which means any part of your stack still running it, including internal connections and APIs, rests on defenses the research says are bypassable.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026