Collected research

Funky chunks – addendum: a few more dirty tricks

Jeppe Bonde Weikop · w4ke.info · 29 October 2025

Extends the chunked-body smuggling family. If one parser blindly skips two bytes as the chunk-body terminator while the other accepts a bare newline, a byte of the next chunk size is consumed and the two disagree on its length. A bare newline in the trailer section gives the same split.

Record

Researcher

Jeppe Bonde Weikop

Published by

w4ke.info

Date

29 October 2025

Topic

Other

In the archive

• Collected in the 2025 research round

Related sources

• Original Funky Chunks research
• AIOHTTP remediation advisory Advisory
• Updated Smugchunks scanner

Tags

• request-smuggling
• parser-differential
• desync
• http
• reverse-proxy
• load-balancer
• prior-art-extension
• cve
• tooling

This page is the archive's own catalogue record. The research is the work of Jeppe Bonde Weikop, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.