PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

HTTP/3 connection contamination: an upcoming threat?

portswigger.net | research | #web-security | #http2 | #reverse-proxy | #http3 | #connection-coalescing | #first-request-routing
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

First-request routing plus browser connection coalescing enables HTTP connection contamination: XSS on one hostname can compromise another sharing the connection — a threat set to grow with HTTP/3.
Published
Collected

Related coverage

blog · bishopfox.com
Traefik | Version Through 3.7.11
Bishop Fox found that Traefik's request read timeout is not applied to HTTP/3, letting unauthenticated clients hold upstream connections open indefinitely; releases since 2.8.2 are affected.
blog · bishopfox.com
h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c)
Jake Miller demonstrates how upgrading HTTP/1.1 connections to HTTP/2 cleartext (h2c) can smuggle requests past reverse proxy access controls and establish long-lived back-end access.
research · portswigger.net
Top 10 web hacking techniques of 2025
PortSwigger's 19th annual Top 10 Web Hacking Techniques, drawn from 63 community nominations and ranked by an expert panel including James Kettle — the must-read web security research of 2025.
research · portswigger.net
Cracking the lens: targeting HTTP's hidden attack-surface
James Kettle cracks the lens of hidden HTTP infrastructure, using malformed requests and esoteric headers to expose reverse proxies and ISP interception, earning over $30k in bounties.
research · portswigger.net
HTTP/2: The Sequel is Always Worse
HTTP/2-exclusive desync attacks: implementation flaws and RFC imperfections enable cache poisoning, credential theft and request tunnelling against ALB, WAFs and CDNs, netting multiple max bounties.
research · portswigger.net
"The entire internet is broken": ethical hacking expert John Hammond meets James Kettle
John Hammond and James Kettle discuss the HTTP/1.1 Must Die research in a video, covering new desync attack classes, CDN compromises, and the case for moving upstream connections to HTTP/2.
Back