Lab: Server-side pause-based request smuggling

Summary: PortSwigger published a lab demonstrating pause-based server-side request smuggling against Apache 2.4.52, where the front-end streams requests to the back-end and the back-end does not close the connection after a timeout on some endpoints. The technique uses a CL.0 desync vector: a request to a valid directory without a trailing slash triggers a server-level redirect, and pausing 61 seconds after the headers lets a smuggled GET /admin request with a Host header of localhost reach the admin panel and delete the user carlos.
Key Takeaway: The exploit needs only a 61-second pause and a redirect-triggering endpoint on Apache 2.4.52, so a front-end that streams requests to a back-end that keeps connections open after timeout can hand an attacker the admin panel without any credentials.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026