# HTTP/1.1 Must Die: What This Means for In-House Pentesters

DevFeed: [HTTP/1.1 Must Die: What This Means for In-House Pentesters](<https://devfeed.tech/articles/http-1-1-must-die-what-this-means-for-in-house-pentesters-7730.md>)

Original publisher: [Read original article](<https://portswigger.net/blog/http-1-1-must-die-what-this-means-for-in-house-pentesters>)

Author: Andrzej Matykiewicz

Published: 2025-08-06T22:23:41Z

Content type: opinion

Language: en

Sources: [PortSwigger Blog](<https://devfeed.tech/sources/portswigger-blog.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [Web](<https://devfeed.tech/topics/web.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>), [backends](<https://devfeed.tech/topics/backends.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [architectures](<https://devfeed.tech/tags/architectures.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [backends](<https://devfeed.tech/tags/backends.md>), [black-hat](<https://devfeed.tech/tags/black-hat.md>), [defcon](<https://devfeed.tech/tags/defcon.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [http](<https://devfeed.tech/tags/http.md>), [research](<https://devfeed.tech/tags/research.md>), [security](<https://devfeed.tech/tags/security.md>), [techniques](<https://devfeed.tech/tags/techniques.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

The article presents PortSwigger research arguing that HTTP request smuggling and desynchronization attacks remain widespread and increasingly difficult to detect. It attributes the risk to inconsistent request-boundary parsing across proxies, CDNs, and distributed backends, and argues that moving upstream traffic to HTTP/2 is a stronger long-term response than patching individual implementations.

## Source excerpt

At Black Hat USA and DEFCON 2025, PortSwigger's Director of Research, James Kettle, issued a stark warning: request smuggling isn't dying out, it's evolving and thriving. Despite years of defensive ef