Response queue poisoning
Summary: PortSwigger Research describes response queue poisoning, a request smuggling attack in which an attacker smuggles a complete request so the back-end returns two responses while the front-end expects one, leaving the extra response queued on the shared front-end/back-end connection. Once poisoned, every subsequent request on that connection is served the previous user's response, letting the attacker capture sensitive data and session tokens by issuing arbitrary follow-up requests until the connection closes, commonly after 100 requests.
Bottom line: The attack requires only that the front-end/back-end TCP connection be reused across requests, and once poisoned it hands the attacker other users' session tokens, which effectively grant full access to their accounts. It also breaks the site for every other user sharing that connection, who receive seemingly random responses.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026