CRLF-Powered Desync Attacks: Beheading HTTP Streams

PortSwigger Research feed containing recent web security research on HTTP request smuggling and desynchronization, authentication bypasses, cookie and parser discrepancies, cache poisoning, SSRF and URL validation bypasses, CSS and CSP-based data exfiltration, JWT or signed-token forgery, WebSocket testing, timing attacks, and related offensive security techniques. The most prominent recent item describes CRLF-powered desync attacks that exploit HTTP header injection and stream parsing inconsistencies. These are research publications and techniques rather than a single confirmed product flaw;—