Smashing the state machine: the true potential of web race conditions
Summary: PortSwigger researcher James Kettle introduced new classes of web race condition attacks that go beyond limit-overrun exploits, demonstrating them against multiple high-profile websites and the Devise authentication framework for Rails. He also detailed the single-packet attack, which sends 20-30 requests from Melbourne to Dublin into a sub-1ms execution window, and reported it was 4 to 10 times more effective than last-byte sync, succeeding in about 30 seconds where last-byte sync took over two hours.
What you should know: Race windows can last around 1ms, and Kettle's single-packet attack collapses that gap regardless of network jitter, turning every multi-step request into a potential exploit path that conventional testing would miss.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026