---
id: 5040
title: "HTTP/1.1 must die: the desync endgame"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/http1-must-die"
published_at: "2025-10-17 10:13"
tags: ["http-desync", "request-smuggling", "cloudflare", "research", "netlify", "akamai", "cdn-security"]
phying_url: "https://phying.com/item/5040"
lang: en
---

# HTTP/1.1 must die: the desync endgame

## Summary

HTTP/1.1 desync attacks can mass-compromise credentials via flaws in Akamai, Cloudflare and Netlify. A parser-discrepancy toolkit earned $200,000 in two weeks — Kettle argues HTTP/1.1 must die.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-10-17 10:13
- **Original:** https://portswigger.net/research/http1-must-die
- **Phying News:** https://phying.com/item/5040