CyberGlossary

Vulnerabilities

HTTP Desync Attack

Also known as: HTTP/1.1 desync, Connection-state attack

Definition

A modern form of HTTP request smuggling that desynchronises a chain of proxies and servers to inject malicious traffic into other users' connections.

Popularised by James Kettle's 2019 "HTTP Desync Attacks" research, desync attacks deliberately put a front-end proxy out of step with the back-end about how to parse a request stream. Techniques include CL.TE, TE.CL, TE.TE, HTTP/2-to-HTTP/1.1 downgrades and chunked-encoding tricks. Once the connection is desynced, attacker-prefixed bytes prepend to the next victim's request — leading to credential theft, internal-endpoint access, response queue poisoning, and bypass of authentication or WAFs. Defences include using fully HTTP/2 paths, strict header validation, rejecting requests that contain both Content-Length and Transfer-Encoding, dropping ambiguous requests at the edge, and continuous testing with tools like HTTP Request Smuggler.

Examples

  • HTTP/2-to-HTTP/1.1 downgrade desync that exfiltrates other users' session cookies.
  • Front-end keep-alive desync that hijacks the next request to an internal admin URL.

Related terms