# HTTP/1.1 must die: the desync endgame

DevFeed: [HTTP/1.1 must die: the desync endgame](<https://devfeed.tech/articles/http-1-1-must-die-the-desync-endgame-7682.md>)

Original publisher: [Read original article](<https://portswigger.net/research/http1-must-die>)

Author: James Kettle

Published: 2025-08-06T22:20:00Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [HTTP](<https://devfeed.tech/topics/http.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Parser](<https://devfeed.tech/topics/parser.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [akamai](<https://devfeed.tech/tags/akamai.md>), [cloudflare](<https://devfeed.tech/tags/cloudflare.md>), [http](<https://devfeed.tech/tags/http.md>), [issue](<https://devfeed.tech/tags/issue.md>), [netlify](<https://devfeed.tech/tags/netlify.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [paper](<https://devfeed.tech/tags/paper.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [security](<https://devfeed.tech/tags/security.md>), [tcp](<https://devfeed.tech/tags/tcp.md>), [tls](<https://devfeed.tech/tags/tls.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

This paper argues that HTTP/1.1 has a fundamental request-boundary flaw that enables HTTP desync and request smuggling attacks. It presents attack techniques, case studies involving Akamai, Cloudflare, and Netlify, an open-source detection toolkit, and the case for replacing HTTP/1.1 with HTTP/2 or later.

## Source excerpt

Abstract Upstream HTTP/1.1 is inherently insecure and regularly exposes millions of websites to hostile takeover. Six years of attempted mitigations have hidden the issue, but failed to fix it. This p