Professional 1.6.39
Summary: Burp Suite Professional 1.6.39, released 3 March 2016, changed how Burp Scanner reports content type mismatches, which it previously flagged on any occasion where the stated content type differed from the actual content. The release bakes in the research team's permutations of browser sniffing factors so Burp only reports the issue when a combination that could lead a browser to interpret a response as HTML is observed, and tightens XSS scan logic to use that same knowledge of browser behavior.
What's compelling: The old check produced enough noise that many users got accustomed to ignoring it, even though in rare situations it can lead to high-severity issues like cross-site scripting - a reminder that alert fatigue can bury the finding that matters.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026