---
id: 5460
title: "HTTP/3 connection contamination: an upcoming threat?"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/http-3-connection-contamination"
published_at: "2022-11-02T14:49:00Z"
tags: ["web-security", "http2", "reverse-proxy", "http3", "connection-coalescing", "first-request-routing"]
phying_url: "https://phying.com/item/5460"
lang: en
---

# HTTP/3 connection contamination: an upcoming threat?

## Summary

First-request routing plus browser connection coalescing enables HTTP connection contamination: XSS on one hostname can compromise another sharing the connection — a threat set to grow with HTTP/3.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-11-02T14:49:00Z
- **Original:** https://portswigger.net/research/http-3-connection-contamination
- **Phying News:** https://phying.com/item/5460