The single-packet attack: making remote race-conditions 'local'
Summary: PortSwigger researcher James Kettle detailed the single-packet attack, a technique that completes multiple HTTP/2 requests in one TCP packet to eliminate network jitter and make remote race conditions as exploitable as local ones. The post extends the analysis to HTTP/3, HTTP/1.1, WebSockets and SMTP, finding HTTP/3 viable but not worth the effort now, HTTP/1.1 and SMTP limited by ordered responses and head-of-line blocking, and WebSockets promising because they have no response ordering.
Key Takeaway: The technique scales to 20-30 simultaneous requests and is already available in Burp Repeater and Turbo Intruder, so race conditions on HTTP/2 sites that were near-impossible to detect are now open to anyone with those tools.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026