# HTTP/1.1 Must Die: What This Means for Contract Pentesters and MSSPs

DevFeed: [HTTP/1.1 Must Die: What This Means for Contract Pentesters and MSSPs](<https://devfeed.tech/articles/http-1-1-must-die-what-this-means-for-contract-pentesters-and-mssps-7729.md>)

Original publisher: [Read original article](<https://portswigger.net/blog/http-1-1-must-die-what-this-means-for-contract-pentesters-and-mssps>)

Author: Andrzej Matykiewicz

Published: 2025-08-06T22:23:07Z

Content type: article

Language: en

Sources: [PortSwigger Blog](<https://devfeed.tech/sources/portswigger-blog.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [backends](<https://devfeed.tech/tags/backends.md>), [bug](<https://devfeed.tech/tags/bug.md>), [complexity](<https://devfeed.tech/tags/complexity.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [http](<https://devfeed.tech/tags/http.md>), [research](<https://devfeed.tech/tags/research.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

PortSwigger argues that HTTP/1.1 request-smuggling vulnerabilities remain widespread because interconnected systems can disagree on request boundaries. The article advocates upstream HTTP/2 and frames the issue as a service opportunity for contract pentesters and MSSPs.

## Source excerpt

At Black Hat USA and DEFCON 2025, PortSwigger's Director of Research, James Kettle, issued a stark warning: request smuggling isn't dying out, it's evolving and thriving. Despite years of defensive ef