HTTP Request Smuggling Explained: with seasoned bug bounty hunter Naham Sec and world-class researcher James Kettle
Summary: In a PortSwigger video, NahamSec and PortSwigger Director of Research James Kettle explain HTTP request smuggling, a class of vulnerabilities still affecting web stacks nearly two decades after it first surfaced. Kettle describes how differences in how front-end and back-end servers interpret HTTP headers let malicious requests bypass security defenses, hijack sessions, poison caches, and compromise entire systems, with the video covering HTTP/2 downgrades, browser-powered desync, and case studies involving Netflix and Atlassian.
What's compelling: Kettle is set to release new desync research at Black Hat USA on 6 August under the banner "HTTP/1.1 Must Die," so a vulnerability class nearly two decades old is still producing new attack techniques against major platforms.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026