What is request smuggling?
Request smuggling is an attack that exploits vulnerabilities in the processing of multiple HTTP requests over the same TCP connection.
Azərbaycanca: Request smuggling hücumu, bir neçə HTTP sorğusunun eyni TCP bağlantısı üzərindən göndərilməsi zamanı baş verən və təhlükəsizlik zəifliklərindən yararlanan hücum növüdür.
How it works
Request smuggling works by manipulating HTTP headers, such as Transfer-Encoding, to cause a discrepancy in how different servers or proxies interpret the request, often due to differences in how HTTP/1.1 and HTTP/2 are handled.
Defense checklist5
- 01
Regularly update HTTP request processing libraries and servers
- 02
Implement proper validation of Transfer-Encoding and other headers
- 03
Address vulnerabilities that occur when adapting HTTP/2 to HTTP/1.1
- 04
Ensure proper handling of chunked messages
- 05
Conduct security audits and penetration testing
Real-world evidence
Incidents like CVE-2026-64785, CVE-2026-66752, CVE-2026-58150, and CVE-2026-57834 demonstrate the occurrence of request smuggling attacks. For example, vulnerabilities were found in SwiftNIO HTTP/2, tiny-http, and Apache Traffic Server.
Sources
- CVE-2026-64785: SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SPnvd
- CVE-2026-66752: tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remonvd
- CVE-2026-58150: Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgnvd
- CVE-2026-57834: Apache Traffic Server allows request smuggling if chunked messages are malformed. This isnvd
Other attack types
See also6
This guide is AI-written from the real incident sources skopnix collected — the examples above are drawn from those cited items, nothing is invented.