HTTP/2 basics for Burp users - Port Swigger
Summary: PortSwigger's overview explains that HTTP/2 requests use a binary format with predetermined offsets instead of the delimiter characters HTTP/1 relies on, so newlines and colons carry no special meaning inside an HTTP/2 request. It notes that HTTP/2 header names and values can technically hold newline characters - prohibited by the specification, but tolerated by some servers - which the article calls the foundation for a number of HTTP/2-exclusive attacks.
What you should know: The parsing assumptions your HTTP/1 defenses were built on do not carry over: a server that tolerates newlines in HTTP/2 header values is exposed to request-smuggling-style attacks that delimiter-based filtering was never designed to catch.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026