Slipping an extra request through Cloudflare Pingora on a close-delimited body
Pingora could not recognise a comma-separated Transfer-Encoding, so it read the request body until the socket closed.
found by Rajat Raghav (xclow3n)
proxies
What does the Squid request smuggling patch actually fix?
The advisory says 'chunked decoder lenience' and stops; the commit says 0x prefixes, bare LFs and a bad rewind point.
found by Keran Mu and Jianjun Chen, Tsinghua University
Space in a token: request smuggling in mitmproxy's HTTP/1.1 parser
mitmproxy split header lines on the first colon and kept whatever came before it, whitespace included.
found by Zeyu Zhang (zeyu2001)
Last write wins: an ext_authz authorization bypass in Envoy
Envoy packed request headers for its external authorizer into a protobuf map, so a repeated header arrived with only its last value.
Smuggling requests past HAProxy with a vertical tab in Transfer-Encoding
How a vertical tab in a Transfer-Encoding header made HAProxy and its backend disagree about where a request ended, opening an HTTP request smuggle.
found by Nathan Davison (independent)