What is HTTP request smuggling? Tutorial & Examples
Summary: HTTP request smuggling is a technique for interfering with how a website processes sequences of HTTP requests from one or more users, and it was first documented in 2005 before being repopularized by PortSwigger's research. Most vulnerabilities arise because the HTTP/1 specification offers two ways to mark where a request ends - the Content-Length header and the Transfer-Encoding header - so chained front-end and back-end servers can disagree about request boundaries and let an attacker prepend data to the next request.
Bottom line: PortSwigger describes these vulnerabilities as often critical, allowing an attacker to bypass security controls, gain unauthorized access to sensitive data, and directly compromise other application users. The exposure sits in the common cloud architecture where an HTTP/2 front-end downgrades requests to HTTP/1 back-ends, so the boundary disagreement happens inside infrastructure you may not control end to end.
Read the original at PortSwigger Research ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026