Pause-based desync attacks

Summary: PortSwigger Research describes pause-based desync attacks, in which a server's read timeout causes it to treat a partial request as complete while leaving the connection open for reuse, enabling CL.0-style request smuggling. The team found this behavior in the widely used Apache HTTP Server during server-level redirects from /example to /example/, reported it, and it was fixed in version 2.4.53.
Bottom line: The technique needs only three conditions - a front-end that forwards each byte immediately, a front-end that does not time out before the back-end, and a back-end that keeps the connection open after a read timeout - so sites that look secure can still be poisoned at the front-end/back-end connection. Apache's exposure during routine redirects shows the flaw can sit in server behavior rather than application code, which is why the fix landed in 2.4.53.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026