HTTP/1.1 must die: Dafydd Stuttard on what this means for enterprise security

Published

2025-10-09 14:06

Collected

2026-07-01 10:59

---
id: 232
title: "HTTP/1.1 must die: Dafydd Stuttard on what this means for enterprise security"
source_domain: portswigger.net
source_url: "https://portswigger.net/blog/http-1-1-must-die-dafydd-stuttard-on-what-this-means-for-enterprise-security"
published_at: "2025-10-09 14:06"
tags: ["http-desync", "request-smuggling", "portswigger", "james-kettle", "http1-must-die", "enterprise-security"]
phying_url: "https://phying.com/item/232"
lang: en
---

# HTTP/1.1 must die: Dafydd Stuttard on what this means for enterprise security

## Summary

Dafydd Stuttard explains the enterprise implications of James Kettle's HTTP desync research: any upstream HTTP/1.1 hop, including CDN downgrades, leaves organizations exposed to request smuggling.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-10-09 14:06
- **Original:** https://portswigger.net/blog/http-1-1-must-die-dafydd-stuttard-on-what-this-means-for-enterprise-security
- **Phying News:** https://phying.com/item/232