# Post Mortem: HTTP Request Smuggling Vulnerability

DevFeed: [Post Mortem: HTTP Request Smuggling Vulnerability](<https://devfeed.tech/articles/post-mortem-http-request-smuggling-vulnerability-22335.md>)

Original publisher: [Read original article](<https://crystal-lang.org/2026/05/26/http-request-smuggling-vulnerability-in-http-server/>)

Author: Julien Portalier

Published: 2026-05-26T00:00:00Z

Content type: article

Language: en

Sources: [Crystal](<https://devfeed.tech/sources/crystal.md>)

Topics: [Post Mortem](<https://devfeed.tech/topics/post-mortem.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Crystal](<https://devfeed.tech/topics/crystal.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Security](<https://devfeed.tech/topics/security.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [access-control](<https://devfeed.tech/tags/access-control.md>), [http](<https://devfeed.tech/tags/http.md>), [post-mortem](<https://devfeed.tech/tags/post-mortem.md>), [rate-limiting](<https://devfeed.tech/tags/rate-limiting.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This post-mortem describes an HTTP request smuggling vulnerability in Crystal's HTTP server. The parser mishandled requests containing conflicting framing headers, allowing request injection between a reverse proxy and a Crystal server under specific proxy conditions. The issue was patched in Crystal 1.20.0 and 1.19.2.

## Source excerpt

On 12 April 2026, we received a vulnerability report regarding an HTTP request smuggling vulnerability in HTTP::Server.