Collected research

HTTP/1.1 must die: the desync endgame

James Kettle · PortSwigger Research · 6 August 2025

New classes of HTTP desync against upstream HTTP/1.1: detecting parser discrepancies with masked headers, making zero-length desyncs exploitable through early-response gadgets and a double-desync that converts them, and desyncs triggered by the Expect header. An attacker poisons a shared front-end connection to hijack other users' requests and take over sites behind major CDNs.

Record

Researcher

James Kettle

Published by

PortSwigger Research

Date

6 August 2025

Topic

HTTP

In the archive

• Collected in the 2025 research round

Related sources

• Research summary and FAQ
• Talk slides Whitepaper
• HTTP Request Smuggler 3.0
• Turbo Intruder offset-discovery script
• RomHack 2025 - James “albinowax” Kettle - HTTP/1.1 Must Die! The Desync Endgame
• Black Hat USA 2025 | HTTP/1.1 Must Die! The Desync Endgame
• DEF CON 33 - HTTP 1 1 Must Die! The Desync Endgame - James 'albinowax' Kettle

Tags

• desync
• request-smuggling
• http
• proxy
• cdn
• cache-poisoning
• http2
• tooling
• bug-bounty

This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.