---
id: 5071
title: "Smashing the state machine: the true potential of web race conditions"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/smashing-the-state-machine"
published_at: "2023-09-18T14:17:00Z"
tags: ["web-security", "research", "race-conditions", "single-packet-attack", "state-machine"]
phying_url: "https://phying.com/item/5071"
lang: en
---

# Smashing the state machine: the true potential of web race conditions

## Summary

New race condition classes beyond limit-overrun exploits compromise major sites and the Devise Rails framework, powered by a single-packet attack squeezing 30 requests into a sub-1ms window.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2023-09-18T14:17:00Z
- **Original:** https://portswigger.net/research/smashing-the-state-machine
- **Phying News:** https://phying.com/item/5071