Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling

Summary: PortSwigger researcher James Kettle presented research at Black Hat USA 2022 and DEF CON 30 showing how a victim's own web browser can be turned into a desync delivery platform, poisoning browser connection pools, installing backdoors, and releasing desync worms. The paper introduces client-side desync and pause-based desync techniques, with case studies compromising Apache, Akamai, Varnish, Amazon, and multiple web VPNs, and describes an AWS Application Load Balancer flaw that AWS fixed within five days.
What's compelling: The attack shifts request smuggling beyond reverse-proxy-fronted systems to single-server websites and internal networks, and because it can be triggered by a specification-compliant request from a browser, the front-end has no chance to block it. Kettle also found a Barracuda WAF and IIS target that had a fix available but never installed it because it shipped as speculative hardening rather than a security release.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026