# Request smuggling desync across hops

Hops disagreeing on request framing: CL vs TE, chunk/trailer parsing, bare CR, redirect body handling

_Area: Web infrastructure and server-side requests. Seen in 23 disclosed reports; 14 confirmed bounties, median $2,150, range $250-$46,000; latest 2026-09-15. Updated 2026-10-23._

## How it works
A request crosses two or more HTTP parsers (CDN, proxy, app server). Each decides where one request ends and the next begins. If they disagree on Content-Length, Transfer-Encoding, chunk/trailer framing, or header delimiters, bytes meant as a body get read as a new request (or vice versa). The connection is then desynchronized: a smuggled prefix attaches to the next user's request. The broken assumption is that every hop parses boundaries identically.

## Where it shows up
- HTTP/2-to-HTTP/1.1 rewriting inside a CDN, then back upstream [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-http1-must-die.md)
- Protocol translators whose header-name comparison is a prefix match, so a short pseudo-header name matches a longer one [E2](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-mad-bugs-my-cousin-vinyl-cve-2026.md)
- Redirect handlers (HTTP-to-HTTPS) that ignore Content-Length and treat the body as a new request [E4](https://bugbountylibrary.com/r/blog%3Ablog-jeti-pw-posts-knocking-on-the-front-door.md)
- Chunked trailer parsing that skips malformed lines or throws mid-parse [E5](https://bugbountylibrary.com/r/h1%3A2299692.md)[E8](https://bugbountylibrary.com/r/h1%3A2280391.md)
- Sanitizers that scan only `req.Header` and never `req.Trailer`, so aliased or `X-Forwarded-*` names arrive as trailers [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-v67p-phpq-fc8x.md)
- Transfer-Encoding matched by case-sensitive substring (`contains("chunked")`), so `Chunked` falls back to CL framing [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-9998-894r-fwvr.md)
- Hop-by-hop headers like `Connection: Content-Length` honored by a proxy [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-9998-894r-fwvr.md)
- CL.TE mismatch where front-end uses Content-Length and back-end honors Transfer-Encoding [E5](https://bugbountylibrary.com/r/h1%3A2299692.md)
- Connection upgrades (H2C) that stop the proxy from inspecting later requests [E7](https://bugbountylibrary.com/r/ghsa%3AGHSA-w4v4-9rw7-5326.md)

## How to review
Identify every parser on the path and compare their boundary rules. The invariant: all hops must agree on exactly one framing (CL or TE, never both), reject ambiguous or malformed framing, and on any parse error abort the connection rather than reuse buffered bytes. Check that redirect and error paths still consume or discard the declared body [E4](https://bugbountylibrary.com/r/blog%3Ablog-jeti-pw-posts-knocking-on-the-front-door.md). Confirm trailer and header-size limits fail closed, discarding residual bytes [E5](https://bugbountylibrary.com/r/h1%3A2299692.md)[E8](https://bugbountylibrary.com/r/h1%3A2280391.md). Check that hop-by-hop headers cannot alter framing [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-9998-894r-fwvr.md). Inspect comparison macros in translators for length semantics, not just call sites [E2](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-mad-bugs-my-cousin-vinyl-cve-2026.md). Treat connection upgrades as a routing boundary the proxy no longer enforces [E7](https://bugbountylibrary.com/r/ghsa%3AGHSA-w4v4-9rw7-5326.md). Verify whether a cache masks the desync: test with and without a cache-buster; if removing it makes the desync appear, the flaw is in the CDN's own rewrite chain [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-http1-must-die.md).

## Variants seen
- H2.0 desync in CDN request rewriting, poisoning shared cache [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-http1-must-die.md)
- Prefix-match on HPACK pseudo-header name desyncs H2-to-HTTP/1.1 translation [E2](https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-mad-bugs-my-cousin-vinyl-cve-2026.md)
- Trailer-only sanitization bypass: header checks miss trailer names [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-v67p-phpq-fc8x.md)
- CL.0 client-side desync via redirect handler, desyncing the browser connection [E4](https://bugbountylibrary.com/r/blog%3Ablog-jeti-pw-posts-knocking-on-the-front-door.md)
- Trailer without colon merging two requests [E5](https://bugbountylibrary.com/r/h1%3A2299692.md)
- Oversized trailer throwing IOException, residual bytes reinterpreted [E8](https://bugbountylibrary.com/r/h1%3A2280391.md)
- Case-sensitive TE substring match causing TE.CL/TE.0 [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-9998-894r-fwvr.md)
- `Connection: Content-Length` honored by CDN proxy [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-9998-894r-fwvr.md)
- CL.TE mismatch behind bot-protection front-end [E5](https://bugbountylibrary.com/r/h1%3A2299692.md)
- H2C upgrade bypassing proxy auth/WAF [E7](https://bugbountylibrary.com/r/ghsa%3AGHSA-w4v4-9rw7-5326.md)

## Impact and severity
Cache poisoning and persistent site takeover across a large shared CDN footprint [E1](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-http1-must-die.md); mass account takeover via captured cookies and reset tokens across many hosts [E5](https://bugbountylibrary.com/r/h1%3A2299692.md); arbitrary-host content served under victim URLs [E6](https://bugbountylibrary.com/r/ghsa%3AGHSA-9998-894r-fwvr.md); auth and WAF bypass via upgrade [E7](https://bugbountylibrary.com/r/ghsa%3AGHSA-w4v4-9rw7-5326.md). Severity rises with shared caches and multi-tenant front ends, where one desync hits many users. E5 and E8 are the same Tomcat trailer parser, so count them once.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-http1-must-die.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-mad-bugs-my-cousin-vinyl-cve-2026.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-v67p-phpq-fc8x.md
- E4: https://bugbountylibrary.com/r/blog%3Ablog-jeti-pw-posts-knocking-on-the-front-door.md
- E5: https://bugbountylibrary.com/r/h1%3A2299692.md
- E6: https://bugbountylibrary.com/r/ghsa%3AGHSA-9998-894r-fwvr.md
- E7: https://bugbountylibrary.com/r/ghsa%3AGHSA-w4v4-9rw7-5326.md
- E8: https://bugbountylibrary.com/r/h1%3A2280391.md