# HTTP/1.1 Must Die: What This Means for AppSec Leadership

DevFeed: [HTTP/1.1 Must Die: What This Means for AppSec Leadership](<https://devfeed.tech/articles/http-1-1-must-die-what-this-means-for-appsec-leadership-7727.md>)

Original publisher: [Read original article](<https://portswigger.net/blog/http-1-1-must-die-what-this-means-for-appsec-leadership>)

Author: Andrzej Matykiewicz

Published: 2025-08-06T22:23:49Z

Content type: article

Language: en

Sources: [PortSwigger Blog](<https://devfeed.tech/sources/portswigger-blog.md>)

Topics: [HTTP](<https://devfeed.tech/topics/http.md>), [Application Security](<https://devfeed.tech/topics/application-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [architectures](<https://devfeed.tech/tags/architectures.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [audit](<https://devfeed.tech/tags/audit.md>), [black-hat](<https://devfeed.tech/tags/black-hat.md>), [defcon](<https://devfeed.tech/tags/defcon.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [http](<https://devfeed.tech/tags/http.md>), [scanner](<https://devfeed.tech/tags/scanner.md>), [security](<https://devfeed.tech/tags/security.md>), [testing](<https://devfeed.tech/tags/testing.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

PortSwigger research presented at Black Hat USA and DEFCON 2025 argues that HTTP/1.1 request smuggling remains a widespread protocol-level threat. Parsing ambiguities in modern chains of interconnected systems can enable session hijacking, cache poisoning, data leakage, and site takeover. The article argues that individual patches are insufficient and recommends upstream HTTP/2 as a stronger long-term solution while organizations audit their exposure to desync vulnerabilities.

## Source excerpt

At Black Hat USA and DEFCON 2025, PortSwigger's Director of Research, James Kettle, issued a stark warning: request smuggling isn't dying out, it's evolving and thriving. Despite years of defensive ef