---
id: 5039
title: "Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/how-to-distinguish-http-pipelining-from-request-smuggling"
published_at: "2025-08-19 14:31"
tags: ["burp-suite", "request-smuggling", "false-positives", "http", "desync", "pipelining"]
phying_url: "https://phying.com/item/5039"
lang: en
---

# Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling

## Summary

Kettle explains how to distinguish HTTP pipelining false positives from real request smuggling, covering connection-locked smuggling, connection state attacks and client-side desync.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-08-19 14:31
- **Original:** https://portswigger.net/research/how-to-distinguish-http-pipelining-from-request-smuggling
- **Phying News:** https://phying.com/item/5039