news
PortSwigger Research
August 5th, 2026 at 11:30 PMCRLF-Powered Desync Attacks: Beheading HTTP Streams
Abstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power
#research
Get stories like this every Monday
The week's most important AI news in one email. Free, unsubscribe anytime.
Score: 2.15
Engagement proxy: 0
Canonical link: https://portswigger.net/research/crlf-powered-desync-attacks