HTTP/1.1 connection reuse returns unsolicited server data as the next request's response (regression in 8.22.0)
HackerOnecurl2026-10-15
Web
Medium
BUG BOUNTY WRITEUPS
HTTP request smuggling writeups
Front-end and back-end servers disagreeing about where a request ends, and what you can do with that.
25 reports and writeups from 2024 to 2026. 20 carry a severity from the disclosing platform, 6 of them rated High or Critical. Last updated 2026-10-30.
Latest HTTP request smuggling reports
Search and filter all writeupsIMAP custom FETCH literals can spoof tagged responses and desynchronize reused connections
HackerOnecurl2026-10-15
Web
Not rated
IMAP literal size truncation on 32-bit platforms corrupts downloads and desynchronizes the response parser
HackerOnecurl2026-10-05
Web
High
HTTP/1.1 response framing violation and unsafe connection reuse when transfer decoding is disabled
HackerOnecurl2026-09-19
Web
Medium
HTTP Request Smuggling via Unsanitized Hop-by-Hop Headers
HackerOneCloudflare Public Bug Bounty2026-09-14$1,500 bounty
Web, Cloud
High
37: `curl_mprintf` `%F` format specifier not consumed, causing variadic argument desynchronization
HackerOnecurl2026-09-14
Web
Not rated
27: IMAP custom FETCH listing classification skips literal boundaries, enabling response desynchronization
HackerOnecurl2026-09-10
Web
Not rated
HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser
HackerOneNode.js2026-08-28
Web
Low
HTTP Request Smuggling via Connection: close in Node.js llhttp parser
HackerOneNode.js2026-07-31
Web
Medium
Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line
HackerOneNode.js2026-07-01
Web
Medium
Incomplete Suppression of Transfer-Encoding: chunked Header in HTTP/2 After Redirect From HTTP/1.1
HackerOnecurl2026-06-15
Web
Low
Duplicate chunked Transfer-Encoding lets a malicious origin smuggle a response across reused HTTP proxy connections
HackerOnecurl2026-06-13
Web
Medium
HTTP Request Smuggling
HackerOneEssity2026-05-20
Web
Critical
HTTP/1.1 Response Desynchronization via conflicting CL/TE headers in Proxy CONNECT
HackerOnecurl2026-03-25
Web
Low
IMAP Protocol Desynchronization and Response Smuggling via Naive Literal Parsing
HackerOnecurl2026-01-14
Web
Low
HTTP Request Smuggling and SSRF via CRLF Injection in Curl_add_custom_headers
HackerOnecurl2026-01-02
Web
High
SMTP CRLF Injection & Protocol Desynchronization in libcurl
HackerOnecurl2025-12-29
Web
Medium
HTTP Request Smuggling Vulnerability Analysis - cURL Security Report
HackerOnecurl2025-07-13
Web
Medium
Improper HTTP header block termination in llhttp
HackerOneNode.js2025-06-13
Web
Medium
Gudifu: Guided Differential Fuzzing for HTTP Request Parsing Discrepancies
Researcher blogATS, Nginx, HAProxy2024-07-25
Web
Not rated
HTTP Request Smuggling via Content Length Obfuscation
HackerOneNode.js2024-05-03
Web
Medium
Making desync attacks easy with TRACE
PortSwigger Research2024-03-19
Web
Not rated
[demo.stripo.email] HTTP request Smuggling
HackerOneStripo Inc2024-02-15
Web
Medium
Request Smuggling in Apache Tomcat (Important, CVE-2023-45648)
HackerOneInternet Bug Bounty2024-02-07$4,660 bounty
Web
High
CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)
HackerOneInternet Bug Bounty2024-01-29$4,660 bounty
Web
High
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.