HTTP/1.1 Must Die: What This Means for Contract Pentesters and MSSPs
Summary: At Black Hat USA and DEFCON 2025, PortSwigger Director of Research James Kettle presented research titled "HTTP/1.1 Must Die: The Desync Endgame," arguing that HTTP request smuggling remains widespread and that patching individual implementations will never eliminate it. The research reports that several major CDNs were found vulnerable to new desync vectors, exposing over 24 million of their customers' websites, and that bypassing existing mitigations earned researchers over $200,000 in bug bounties.
Why it matters: More than 24 million websites sat behind CDNs vulnerable to these desync vectors, and the mitigations meant to stop request smuggling have made the flaws harder to detect rather than rarer.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026