---
id: 5478
title: "HTTP/2: The Sequel is Always Worse"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/http2"
published_at: "2025-09-03T07:37:00Z"
tags: ["black-hat", "web-security", "request-smuggling", "http2", "desync", "request-tunnelling"]
phying_url: "https://phying.com/item/5478"
lang: en
---

# HTTP/2: The Sequel is Always Worse

## Summary

HTTP/2-exclusive desync attacks: implementation flaws and RFC imperfections enable cache poisoning, credential theft and request tunnelling against ALB, WAFs and CDNs, netting multiple max bounties.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-09-03T07:37:00Z
- **Original:** https://portswigger.net/research/http2
- **Phying News:** https://phying.com/item/5478