Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →HTTP request smuggling happens when components in the same request path disagree about where one request ends and the next begins. In a common HTTP/1.1 case, a proxy and an origin server interpret conflicting message-framing headers differently; bytes treated as body data by one can become a separate request to the other.
What is HTTP request smuggling?
Request smuggling exploits differences in how HTTP recipients parse a message. RFC 9112, Section 11.2, defines it as a technique that exploits “differences in protocol parsing among various recipients” to hide additional requests inside an apparently harmless one.
As an Amazon Associate I earn from qualifying purchases.
Picture a request passing through a chain that might include a CDN, a reverse proxy, a web application firewall, a load balancer, and an origin server. If an upstream component decides the request ends at byte position A while a downstream component decides it ends at position B, the bytes between those boundaries have different meanings to each. What the first component considers part of the body may be read by the next as the start of another request.
Free tools Windows power users keep installed
One-click scans. No signup required.
The important feature is the disagreement between parsers or transformations, not the number of physical machines. When components share a persistent connection, leftover bytes can also desynchronize that connection: a later request may be combined with the bytes left behind. The exact result depends on the request path and how each component routes and handles requests.
#1 Best Overall
How can two servers disagree about one request?
HTTP/1.1 needs a way to determine where a message body ends. Two relevant headers are Content-Length, which specifies a body length in bytes, and Transfer-Encoding: chunked, which frames the body as chunks ending with a terminating chunk. If components give conflicting framing information different priority—or interpret a malformed header differently—they can calculate different request boundaries.
For example, a front-end proxy might use the declared content length to decide what to forward, while the back-end server follows chunked encoding and stops reading at its end marker. Any bytes that remain may then be interpreted by the back end as a new request. Reversing which component follows which framing rule can leave a different set of bytes for the next request.
What are CL.TE, TE.CL, and TE.TE?
These labels describe which framing interpretation the front end and back end use. They are not separate protocols, and a label alone does not establish that a particular system is vulnerable.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Pattern | Front end | Back end | How the boundary can diverge |
|---|---|---|---|
| CL.TE | Uses Content-Length |
Uses Transfer-Encoding: chunked |
The back end may stop at the chunked end marker while the front end forwards additional bytes based on the declared length. |
| TE.CL | Uses Transfer-Encoding: chunked |
Uses Content-Length |
The back end may stop at the declared length while the front end has processed the body using chunked framing, leaving bytes to be read as another request. |
| TE.TE | Recognizes transfer encoding | Also recognizes transfer encoding, but parses an obfuscated header differently | One parser may accept or recognize a noncanonical transfer-encoding field that the other ignores. The exact syntax and behavior are implementation-dependent. |
In each case, exploitability depends on the actual proxy-and-origin combination, connection reuse, routing, and application behavior. There is no single malformed header form that works universally.
What can request smuggling let an attacker do?
A smuggled request may be processed differently from the request that the front end believes it has inspected. Depending on the architecture, that can let an attacker bypass controls enforced at an earlier layer, reach internal or sensitive resources, poison a web cache, or affect other users whose requests share a connection or cache. These are possible outcomes, not guaranteed consequences: they require the relevant routing, connection, cache, and application conditions to line up.
Does HTTP/2 prevent request smuggling?
HTTP/2 carries message bodies in DATA frames with explicit frame lengths. When the relevant request path uses HTTP/2 consistently, the classic HTTP/1.1 ambiguity between content length and chunked transfer framing is absent.
Rank #3
HTTP/2 end to end
Using HTTP/2 across the relevant proxy-to-origin path avoids translating the request into HTTP/1.1 at that boundary. It addresses the classic framing conflict, though the components still need correct protocol handling.
HTTP/2 at the edge, HTTP/1.1 to the origin
A service can accept HTTP/2 from a browser and then downgrade the request to HTTP/1.1 for an older origin. At that translation point, the front end has to serialize and validate the request correctly. Flawed translation or validation can reintroduce framing discrepancies, including conditions described as H2.CL and H2.TE. PortSwigger’s research on HTTP/2 downgrade attacks explains why HTTP/2 support at the client-facing edge alone is not proof that the whole path is safe.
As PortSwigger researcher James Kettle put it in an article published on August 5, 2021, and updated September 3, 2025: “HTTP/2 is easily mistaken for a transport-layer protocol that can be swapped in with zero security implications for the website behind it.” The practical question is which protocol each hop actually uses and how any translation is handled.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do you prevent HTTP request smuggling?
Prevention is primarily about making every component agree on message boundaries—or rejecting a request before it can be interpreted differently downstream.
- Use HTTP/2 end to end where feasible. Check the protocol between each proxy, load balancer, and origin, not only the browser-facing connection.
- Validate every downgrade to HTTP/1.1. Ensure the rewritten message conforms to HTTP/1.1 framing rules. Reject malformed header names, embedded newlines, invalid methods, and ambiguous framing instead of allowing different components to repair or interpret them differently.
- Normalize or reject ambiguous input at the front end. Configure the back end to reject any ambiguity that remains, so it does not apply a different interpretation.
- Close the connection after a parsing or framing error. RFC 9112 says a server receiving a sequence that does not match the HTTP-message grammar, apart from specified robustness exceptions, should respond with
400 Bad Requestand close the connection. This prevents leftover bytes from contaminating a reused connection. - Review the whole request chain. Include the CDN, WAF, proxy, load balancer, and origin in the audit. Agreement at only one hop is not enough.
- Test the protocols and translations actually in use. Assess HTTP/1.1 paths and HTTP/2-to-HTTP/1.1 downgrade paths in an authorized staging environment or assessment.
RFC 9112 also warns that forwarding a message containing both Transfer-Encoding and Content-Length can create smuggling risk if downstream recipients parse it incorrectly. An intermediary that forwards such a message must remove Content-Length and correctly process Transfer-Encoding. Prefer rejecting ambiguous input over relying on inconsistent handling by downstream systems.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteReducing connection reuse can limit some effects, but it is a mitigation rather than a complete fix: it does not resolve the underlying parsing disagreement or eliminate every possible exploit.
Best Value
How should teams validate a request path?
Burp Suite’s HTTP Request Smuggler extension is documented as automating detection and testing, and its listing identifies compatibility with Burp Suite DAST, Professional, and Community editions. Burp documentation also describes protocol selection and HTTP/2 handling, including HTTP/1 testing for classic CL.TE and TE.CL cases.
Use testing tools only against systems you own or are explicitly authorized to assess. Treat automated output as evidence to investigate, not as a verdict: confirm any finding against the actual proxy-and-origin chain, and do not treat a negative automated test as proof that no smuggling condition exists. HTTP/2 fundamentals are useful background for understanding frames, streams, and downgrade context, but a general HTTP/2 book is not a dedicated request-smuggling manual.
No representative population-level prevalence figure is established here. Individual case studies or bug-bounty findings cannot show what share of websites are vulnerable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
