# Response desync via malformed framing

1xx, negative content-length, or body-skip rules shifting request-response pairing

_Area: Web infrastructure and server-side requests. Seen in 2 disclosed reports; latest 2026-08-05. Updated 2026-10-24._

## How it works
A proxy or client keeps a queue pairing each outbound request with its inbound response. The pairing assumes one response per request and that framing rules (body length, body-skip) apply to the correct request. That assumption breaks when informational responses, unknown-length sentinels, or body-skip rules are mishandled: the queue advances on the wrong message, and later bytes are attributed to the wrong request. The result is a shifted pairing where one client reads another's response.

## Where it shows up
- Response-pairing code that polls the request queue once per inbound message, including 1xx [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-57rv-r2g8-2cj3.md).
- Body-skip logic for HEAD/204/304 applied without confirming which request it is paired to [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-57rv-r2g8-2cj3.md).
- Buffer sizing from a framework length field that uses a sentinel for unknown length (Go `ContentLength == -1` for chunked/HTTP-2) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rw47-hm26-6wr7.md).
- Clamping that sentinel to zero, producing an empty read that silently drops the body [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rw47-hm26-6wr7.md).
- Shared request/response parsers where response-only headers (e.g. Content-Location) are accepted in requests [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-can-ai-do-novel-security-research.md).
- Unusual method/header/body combinations (DELETE with Content-Location, TRACE with body) [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-can-ai-do-novel-security-research.md).

## How to review
The invariant: every inbound message must be paired to exactly one request, and framing decisions must use that request's method and the actual body length. Check that 1xx responses do not consume pairing state [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-57rv-r2g8-2cj3.md); that body-skip rules are evaluated against the paired request, not the next one [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-57rv-r2g8-2cj3.md); that unknown-length bodies are read to EOF rather than sized from a sentinel [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rw47-hm26-6wr7.md); and that request parsing rejects response-only framing features [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-can-ai-do-novel-security-research.md). Trace one request end-to-end and confirm the byte stream is consumed exactly once.

## Variants seen
- Informational 1xx response advancing the pairing queue, then HEAD body-skip misapplied to a preceding GET [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-57rv-r2g8-2cj3.md).
- Negative/unknown content-length clamped to zero, silently dropping chunked or HTTP-2 bodies [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rw47-hm26-6wr7.md).
- Response-specific header accepted in a request, desyncing the server's response queue [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-can-ai-do-novel-security-research.md).

## Impact and severity
Consequences range from silent WAF bypass of all body rules [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-rw47-hm26-6wr7.md) to response queue poisoning where clients receive other users' responses [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-can-ai-do-novel-security-research.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-57rv-r2g8-2cj3.md). Severity is high because the failure is silent and defeats inspection; shared parsers and pipelining widen the blast radius.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-can-ai-do-novel-security-research.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-rw47-hm26-6wr7.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-57rv-r2g8-2cj3.md