Skip to content
Making HTTP header injection critical via response queue poisoning
portswigger.net | research | #bug-bounty | #web-security | #proxy | #http-request-smuggling | #response-queue-poisoning | #header-injection
Summary
How a path-based header injection was upgraded into critical response queue poisoning: injecting Connection: keep-alive and a smuggled request poisons other users' responses, earning a $12,500 bounty.
- Published
- Collected