Professional / Community 2022.5.1
Summary: PortSwigger released Burp Suite Professional/Community 2022.5.1 on 16 June 2022, adding eight new JWT-based scan checks, an option to skip unauthenticated crawling when application logins are provided, and estimated system-load indicators for BApps in the BApp Store. The release also adds a session handling action to set specific header values, an optional Verify upstream TLS setting under Project settings, an upgrade to Chromium 102.0.5005.61, and a new requirement for Java 11 or later.
What you should know: Burp by default does not verify upstream TLS certificates and supports weak ciphers when talking to arbitrary sites, which the release notes describe as maximizing compatibility at the expense of protection against active man-in-the-middle attacks - a tradeoff testers should decide on deliberately rather than inherit.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026