Web cache poisoning
Summary: Web cache poisoning is a technique in which an attacker exploits the behavior of a web server and cache so that a harmful HTTP response is served to other users, in two phases: first eliciting a response from the back-end server that contains a dangerous payload, then getting that response cached and served to victims. PortSwigger says the technique was first popularized by its 2018 research paper "Practical Web Cache Poisoning" and developed further in 2020 with "Web Cache Entanglement: Novel Pathways to Poisoning."
What you should know: Caches decide whether requests are equivalent by comparing a cache key, typically the request line and Host header, and ignore all other "unkeyed" components - so a payload injected through an unkeyed header such as X-Forwarded-Host can be served to every user whose request matches that key, and an attack can usually be scripted to re-poison the cache indefinitely regardless of entry duration.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026