Performing HTTP/2-exclusive attacks - Port Swigger
Summary: PortSwigger's Burp Suite now lets testers edit HTTP/2 headers and pseudo-headers as separate name and value fields in the Inspector, decoupled from HTTP/1 syntax, so they can inject colons into header names and arbitrary spaces or newlines into the method, path, header names, and header values. The specification says servers should reject these injections, but some tolerate them, and Burp is described as the only tool that enables taking advantage of this behavior.
Key Takeaway: Some servers accept malformed HTTP/2 headers that the specification says they should reject, and Burp is currently the only tool built to send them - so the request-smuggling and header-injection exposure sits in servers your scanners may not be exercising.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026