Professional / Community 2022.9.5

Summary: PortSwigger released Burp Suite Professional/Community 2022.9.5 on 27 October 2022, introducing the Montoya API as a replacement for the Wiener API, with the old API continuing to work for the immediate future. The release also added automatic renewal of license keys, adaptive request throttling that adds incremental delays when Burp Scanner receives a 429 response, a fix for an HTML injection vulnerability reachable by attackers with direct access to the proxy listener, and an upgrade to Chromium 107.0.5304.62.
What you should know: The HTML injection flaw required direct access to the proxy listener, which by default only accepts localhost connections, and was reported privately through the bug bounty program. Extensions built on the Wiener API will eventually lose support, so teams maintaining Burp extensions face a migration to Montoya.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026