Slipping an extra request through Cloudflare Pingora on a close-delimited body
Pingora could not recognise a comma-separated Transfer-Encoding, so it read the request body until the socket closed.
found by Rajat Raghav (xclow3n)
http
A request header made Next.js cache private per-user responses
One internal header flips an SSR response into an SSG one, and the Cache-Control header follows it.
found by Allam Rachid (zhero_) and Henry Chen
What does the Squid request smuggling patch actually fix?
The advisory says 'chunked decoder lenience' and stops; the commit says 0x prefixes, bare LFs and a bad rewind point.
found by Keran Mu and Jianjun Chen, Tsinghua University
Traversing a path into the Home Assistant Supervisor API without a token
An unauthenticated allow-list matched a string while a proxy client normalised a path, three times in a row.
found by Joseph Surin and Victor Kahan, elttam
Space in a token: request smuggling in mitmproxy's HTTP/1.1 parser
mitmproxy split header lines on the first colon and kept whatever came before it, whitespace included.
found by Zeyu Zhang (zeyu2001)
Last write wins: an ext_authz authorization bypass in Envoy
Envoy packed request headers for its external authorizer into a protobuf map, so a repeated header arrived with only its last value.
Python's parse_qsl treated semicolons as separators, enabling web cache poisoning
A standard-library parser that separated parameters on ';' as well as '&', and the cache poisoning that followed when the proxy in front disagreed.
found by Adam Goldschmidt (Snyk)
Smuggling requests past HAProxy with a vertical tab in Transfer-Encoding
How a vertical tab in a Transfer-Encoding header made HAProxy and its backend disagree about where a request ended, opening an HTTP request smuggle.
found by Nathan Davison (independent)