Professional / Community 2021.9.1

Summary: PortSwigger released Burp Suite Professional/Community 2021.9.1 on 26 October 2021, enabling manual testing of hidden HTTP/2 attack surface by letting Burp Repeater send HTTP/2 requests even when the server doesn't advertise HTTP/2 support via ALPN. The release also added server-side template injection payloads for Java-based template engines, integrated additional out-of-band detection via Burp Collaborator, and updated the embedded browser to Chromium 95.0.4638.54 to fix a number of high-severity bugs.
Key Takeaway: The HTTP/2 ALPN override lets testers reach attack surface that servers don't advertise, which cuts both ways: the same hidden endpoints your scanner can now probe are reachable by anyone else running the tool.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026