Making HTTP header injection critical via response queue poisoning
Summary: PortSwigger researcher James Kettle described a technique that upgrades HTTP header injection into a request desync, letting an attacker poison the response queue so they intermittently receive responses meant for other authenticated users. Applied to a path-based request header injection on a high-traffic site reported by researcher xorb, the method earned a $12,500 bounty and was patched in under 24 hours.
Bottom line: Header injection is routinely triaged as moderate, but this chain turned it into cross-user data exposure on a site serving critical functionality - and the fix landed in under a day once critical impact was demonstrated.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026