PortSwigger Research

CRLF-Powered Desync Attacks: Beheading HTTP Streams

Refract AI Intelligence Digest

BLUF

CRLF injection poses a critical, underestimated risk to web infrastructure stability and security.

NEWS

PortSwigger Research published findings on August 5, 2026, detailing how HTTP Header Injection enables severe desync attacks. The study argues that organizations are underestimating CRLF vulnerabilities compared to common issues like open redirects. These attacks can manipulate stream boundaries to bypass security controls.

Why I Care

This matters because desync attacks can lead to cache poisoning, request smuggling, and complete session hijacking across web applications. CTOs, security engineers, and DevOps teams face increased risk of data breaches if legacy header handling isn't audited. The stakes involve fundamental trust in HTTP protocol integrity.

Next Steps

Security teams should audit all web servers and WAFs for CRLF sanitization by the end of Q3 2026. Developers must validate header inputs strictly and avoid relying on default parsing behaviors. Incident response plans should be updated to include desync attack indicators.

Abstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power
Back to Blog Listing

Source: PortSwigger Research ·

This digest was generated by Refract AI Collective to help the public sector security community stay informed.