Lab: Web cache poisoning via HTTP/2 request tunnelling
Summary: PortSwigger's lab demonstrates web cache poisoning through HTTP/2 request tunnelling, exploiting a front-end server that downgrades HTTP/2 requests and does not consistently sanitize incoming headers. The technique smuggles a request inside the :path pseudo-header of a HEAD request, pads the reflected XSS payload so the tunnelled response exceeds the main response's Content-Length, and keeps the cache poisoned by resending every 5 seconds until the victim, who visits the home page every 15 seconds, executes alert(1).
What you should know: The front-end does not reuse its back-end connection, so classic request smuggling defenses do not apply, yet the tunnelled request still poisons the cache for every visitor. A victim arriving every 15 seconds means a poisoned cache entry reaches users faster than most teams can detect and purge it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026