Professional / Community 2024.12.1

Summary: PortSwigger released Burp Suite Professional / Community 2024.12.1 on 24 January 2025, adding a capture filter to the Burp Intruder attack results window so users can choose which response types Intruder captures during an attack. The release also adds automatic Base64 and Q-encoded decoding of SMTP messages in Burp Collaborator, aria-label-based element identification for recorded logins, Montoya API options for custom SNI and request timeouts, and an upgrade to Chromium 132.0.6834.84 on Windows and Mac and 132.0.6834.83 on Linux.
Why it matters: The Montoya API now lets extensions set a custom SNI field and per-request timeouts, which the release ties directly to testing HTTP Host header attacks - the same class of flaw Collaborator's new SMTP decoding is meant to help analyze.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026