Professional / Community 2021.9

Summary: PortSwigger released Burp Suite Professional/Community 2021.9 on 12 October 2021, enabling manual testing of hidden HTTP/2 attack surface by letting Burp Repeater send HTTP/2 requests even when the server doesn't advertise support via ALPN. The release also added server-side template injection payloads for Java-based template engines, integrated additional out-of-band detection via Burp Collaborator, and improved crawler handling of single-page application forms, iframes, multi-selects, scrolling elements, and SVG elements in recorded login sequences.
What you should know: The ALPN override means testers can reach HTTP/2 endpoints that servers don't advertise, so an attack surface your team assumed was closed may simply be hidden from standard clients.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026