---
id: 5462
title: "Making HTTP header injection critical via response queue poisoning"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning"
published_at: "2022-09-26T14:26:00Z"
tags: ["bug-bounty", "web-security", "proxy", "http-request-smuggling", "response-queue-poisoning", "header-injection"]
phying_url: "https://phying.com/item/5462"
lang: en
---

# Making HTTP header injection critical via response queue poisoning

## Summary

How a path-based header injection was upgraded into critical response queue poisoning: injecting Connection: keep-alive and a smuggled request poisons other users' responses, earning a $12,500 bounty.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-09-26T14:26:00Z
- **Original:** https://portswigger.net/research/making-http-header-injection-critical-via-response-queue-poisoning
- **Phying News:** https://phying.com/item/5462