PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2019-16276] HTTP Desync Attacks: what happened next

portswigger.net | research | CVE-2019-16276 | #http-desync | #request-smuggling | #vulnerability | #portswigger | #f5 | #akamai | #cve-2019-16276
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

James Kettle follows up on HTTP Desync Attacks with vendor patches from Akamai, F5, HAProxy and Go's CVE-2019-16276, plus fresh desync techniques that expose more systems.
CVE
CVE-2019-16276
Published
Collected

Related coverage

research · portswigger.net
CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.
research · portswigger.net
HTTP/1.1 must die: the desync endgame
HTTP/1.1 desync attacks can mass-compromise credentials via flaws in Akamai, Cloudflare and Netlify. A parser-discrepancy toolkit earned $200,000 in two weeks — Kettle argues HTTP/1.1 must die.
research · portswigger.net
Can AI do novel security research? Meet the HTTP Terminator
James Kettle's Black Hat USA 2026 research: the HTTP Terminator, an autonomous system that invented novel HTTP desync triggers and exploited banks, security products and government infrastructure.
research · portswigger.net
Can AI do novel security research? Meet the HTTP Terminator
James Kettle's HTTP Terminator is an autonomous system that invented new HTTP desync attack techniques and used them to compromise banks, security tools, and government infrastructure at scale.
research · portswigger.net
HTTP Desync Attacks: Request Smuggling Reborn
James Kettle revives HTTP Request Smuggling as HTTP Desync Attacks, splicing requests into victims' connections to poison caches and compromise PayPal's login page, earning over $70k in bounties.
blog · portswigger.net
Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research
This coverage gives security teams current context for monitoring, validation, and remediation.
Back