# Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling

DevFeed: [Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling](<https://devfeed.tech/articles/beware-the-false-false-positive-how-to-distinguish-http-pipelining-from-request-smuggling-7681.md>)

Original publisher: [Read original article](<https://portswigger.net/research/how-to-distinguish-http-pipelining-from-request-smuggling>)

Author: James Kettle

Published: 2025-08-19T14:30:44Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [HTTP](<https://devfeed.tech/topics/http.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [false-positive](<https://devfeed.tech/tags/false-positive.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [http](<https://devfeed.tech/tags/http.md>), [tcp](<https://devfeed.tech/tags/tcp.md>), [tls](<https://devfeed.tech/tags/tls.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This article explains how to distinguish HTTP pipelining, keep-alive, and connection reuse from genuine HTTP request smuggling vulnerabilities. It recommends disabling connection reuse when testing and introduces Burp Suite tools that help analyze low-level HTTP behavior.

## Source excerpt

Sometimes people think they've found HTTP request smuggling, when they're actually just observing HTTP keep-alive or pipelining. This is usually a false positive, but sometimes there's actually a real