HTTP/3 connection contamination: an upcoming threat?
Summary: PortSwigger researcher James Kettle documented how first-request routing in reverse proxies, combined with browser HTTP connection coalescing, lets a request to one hostname be routed to another back-end on the same connection, so XSS on wordpress.example.com can be used to compromise secure.example.com. He notes the threat is currently rare because first-request routing is uncommon and HTTP/2 servers are a small pool, but HTTP/3 proposes removing the IP address match requirement, which would expose any front-end using first-request routing with a certificate valid for multiple hosts.
Why it matters: HTTP/3 would also mean a compromised server holding a wildcard certificate can attack sibling domains without an active man-in-the-middle, widening the pool of actors who could profit from it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026