Collected research

HTTP/3 connection contamination: an upcoming threat?

James Kettle · PortSwigger Research · 19 October 2022

Browsers coalesce requests for different hostnames onto one HTTP/2 or HTTP/3 connection when the hosts share an IP address and certificate, while a reverse proxy that picks its backend from the first request on a connection then misroutes everything after it. XSS on one sibling host therefore becomes control of a more sensitive one, and HTTP/3 removes the IP-match requirement.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

19 October 2022

Topic

HTTP

In the archive

• Collected in the 2022 research round

Related sources

• Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling
• Detection extension
• HTTP/3 Connection Contamination Made Simple - James Kettle (albinowax)

Tags

• sop-bypass
• http3
• http2
• reverse-proxy
• xss
• tls
• load-balancer
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.