Lab: HTTP request smuggling, basic CL.TE vulnerability
Summary: This PortSwigger lab sets up a front-end and back-end server pair where the front end does not support chunked encoding and rejects any request that is not GET or POST. The goal is to smuggle a request to the back end so that its next processed request appears to use the method GPOST, which the lab says requires HTTP/1 techniques even though HTTP/2 is supported.
Key Takeaway: The mismatch here is small and specific: a front end that won't parse chunked encoding and a back end that will, which is enough to make the back end see a request the front end never approved. Any proxy or load balancer that disagrees with the server behind it on how to read request boundaries carries the same exposure.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026