HTTP request tunnelling
Summary: PortSwigger Research describes HTTP request tunnelling, a technique that sends a single request eliciting two responses from the back-end, hiding a request and its response from the front-end even when connection reuse is restricted. The technique works over HTTP/1 and HTTP/2, is harder to detect in HTTP/1-only environments, and can be made non-blind using HEAD requests to over-read the tunnelled response.
What's compelling: Even mechanisms designed specifically to prevent request smuggling fail to stop request tunnelling, and caches on the front-end can be tricked into serving mixed responses to other users, turning a limited smuggling variant into high-severity web cache poisoning and reflected XSS.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026