HTTP Desync Attacks: Request Smuggling Reborn
Summary: PortSwigger researcher James Kettle published research on HTTP desync attacks, reviving HTTP request smuggling first documented by Watchfire in 2005, using discrepancies in how front-end and back-end servers parse Content-Length and Transfer-Encoding headers to splice attacker requests into other users' requests. Kettle reports using the technique against numerous commercial and military systems, poisoning web caches, compromising PayPal's login page, and earning over $70k in bug bounties, with Akamai deploying a fix roughly 48 hours after publication.
Why it matters: The attack works because front-end and back-end servers disagree on where one HTTP request ends and the next begins, and Kettle's detection method relies on inducing timeouts rather than poisoning live sockets, meaning the vulnerability can exist silently in any multi-tier architecture until someone proves it. Kettle harvested over $70k in bounties from systems that included military and commercial targets, and notes that high-traffic sites may require thousands of attempts to confirm exploitation.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026