h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c)

Published

2020-09-08 00:00

Collected

2026-07-08 02:10

---
id: 4118
title: "h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c)"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/h2c-smuggling-request"
published_at: "2020-09-08T00:00:00Z"
tags: ["web-security", "request-smuggling", "vulnerability", "http2", "h2c", "reverse-proxy"]
phying_url: "https://phying.com/item/4118"
lang: en
---

# h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c)

## Summary

Jake Miller demonstrates how upgrading HTTP/1.1 connections to HTTP/2 cleartext (h2c) can smuggle requests past reverse proxy access controls and establish long-lived back-end access.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2020-09-08T00:00:00Z
- **Original:** https://bishopfox.com/blog/h2c-smuggling-request
- **Phying News:** https://phying.com/item/4118