HTTP/2 downgrading
Summary: PortSwigger Research explains that front-end servers supporting HTTP/2 commonly rewrite incoming requests into HTTP/1 syntax to talk to legacy back-end infrastructure, then reverse the process on responses, and that this downgrading is extremely widespread and the default behavior for several popular reverse proxy services, sometimes with no option to disable it. Because HTTP/2 has its own built-in length mechanism, downgrading can leave potentially three different ways to specify the length of the same request, which the research identifies as the basis of all request smuggling attacks.
Key Takeaway: HTTP/2 is generally considered immune to request smuggling when used end to end, but the downgrade to HTTP/1 back ends reintroduces the length ambiguity that smuggling depends on - and for some reverse proxies there is no setting to turn it off.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026