Preliminary research

HTTP/3 in Burp Suite: programmable HTTP/3 testing and race tooling

HTTP/3 in Burp Suite - it’s time to find a bigger wordlist

Tom Stacey · PortSwigger · 23 September 2026

AI-collected research leads through 24 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Introduces HTTP/3 engines and automatic tuning in Turbo Intruder, integrates Single Datagram and QPACK blocked-stream race techniques, and shows downgrade-header testing. An HTTP/3 Adapter extends Burp testing to HTTP/3-only services. Includes configuration tables and request examples.

Record

Document

HTTP/3 in Burp Suite - it’s time to find a bigger wordlist

Researcher

Tom Stacey

Published by

PortSwigger

Date

23 September 2026

Topic

HTTP

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Turbo Intruder
• HTTP/3 Adapter
• Throughput demonstration

Tags

• http3
• race-condition
• request-smuggling
• tooling
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Tom Stacey, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 24 September 2026.