Professional / Community 2020.5

Summary: PortSwigger released Burp Suite Professional / Community 2020.5 on 5 June 2020, adding an HTTP message editor option to display non-printing characters as lozenges for any byte with a hexadecimal value below 20, including tabs, line feeds, carriage returns, and null bytes. The lozenges are hidden by default and toggled with the "\n" button at the bottom of the editor, and the release also includes minor improvements and bug fixes.
Why it matters: Hidden bytes like nulls and carriage returns are exactly where request smuggling and parser-differential bugs hide, and until now Burp's message editor showed them only in hex view - so testers could miss what the target server actually parses.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026