Client-side desync
Summary: Client-side desync vulnerabilities occur when a web server fails to correctly process the Content-Length of POST requests, letting an attacker force a victim's browser to desynchronize its connection with the website, typically leading to XSS. PortSwigger lists three fixes: patch the server to process POST requests correctly or close the connection after handling them, disable connection reuse entirely at a possible performance cost, or enable HTTP/2.
What you should know: The attack runs through the victim's own browser rather than the attacker's infrastructure, so a server that mishandles Content-Length on POST requests turns every visiting user into the delivery mechanism for XSS.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026