Source reading · Kettle 2025, HTTP/1.1 Must Die · nine desync classes, the discrepancy-first probe, and what decides whether a report gets paid

Kettle · PortSwigger · August 2025

The desync endgame

HTTP/1.1 puts no delimiter between requests and offers four ways to say how long one is. Every proxy in the chain guesses. When two guess differently, the leftover bytes become the opening lines of somebody else's request. This is a source reading of one document - James Kettle's HTTP/1.1 Must Die (PortSwigger Research, August 2025) - turned into nine modules you can work: the class grid, the probe methodology that replaced attack-first testing, the 0.CL deadlock, the double-desync that breaks it, and the reach and impact questions that decide a report. It is a study aid for authorized testing, not a substitute for the paper.

  • PaperMechanism, class name, or claim the anchor document sets out. Checkable against it.
  • FieldA reported case with a named finder, vendor, or bounty. Checkable outside the paper too.
  • SimIllustrative. The requests, byte counts, and scan results below are constructed to show the shape. Nothing here sends traffic, and no number produced by a control is a measurement.

The nine interactive modules need JavaScript. The framing above and the sources below are the static part of this page.

Sources

Kettle J. 2025. HTTP/1.1 must die: the desync endgame. PortSwigger Research, August 2025. portswigger.net/research/http1-must-die · FAQ and vendor tracking: http1mustdie.com

Everything in modules 01 to 09 is read from that paper unless a card names another source. Where the paper credits someone else, this page keeps the credit: Tom Stacey on the AWS Desync Guardian bypass, Wannes Verwimp on the Cloudflare to Heroku 0.CL, sw33tLie, bsysop and Medusa on TE.0, Stacey and Righi on the browser-powered and CRLF-driven follow-ups, Regilero on the 2016 work, and Linhart and colleagues on the 2004 original.

Tooling named on the page: HTTP Request Smuggler 3.0 and the 0cl-find-offset script for Turbo Intruder, both from PortSwigger; the 0.CL Request Smuggling lab in the Web Security Academy.

The paper is a vendor research publication, not a peer-reviewed venue, and has no DOI. Bounty totals, site counts, and request counts on this page are the paper's own reported figures, quoted as it states them rather than independently verified.