HTTP/3 in Burp Suite - it’s time to find a bigger wordlist
2026-09-30T08:51:48Z•6940c4dbe0ffd0da894479ef37bbdeb5b35679ada42b02a06cdc724ce8cba833
Burp-SuiteCORSCSP-bypassCSS-injectionHTTP-3HTTP-desyncHTTP-request-smugglingJWTSAMLSSRFURL-validationXSSapplication-securityauthentication-bypasscookie-securitydata-exfiltrationoffensive-securityopen-redirectparser-discrepancysecurity-testingtiming-attackstoken-forgeryweb-cache-poisoningweb-researchweb-security
What happened
PortSwigger Research feed aggregating web security research published from 2024 through 2026. Topics include HTTP/2 and HTTP/3 desynchronization, request smuggling, SAML authentication bypasses, cookie and parser discrepancies, CSS and XSS data exfiltration, URL validation bypasses, cache poisoning, CSP bypasses, JWT and signed-token forgery, timing attacks, and offensive security tooling. Several entries describe potentially critical authentication bypasses and request desynchronization attacks, but the feed itself is a research collection rather than a single vulnerability advisory.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- portswigger_research
- Record identifier
- 6940c4dbe0ffd0da894479ef37bbdeb5b35679ada42b02a06cdc724ce8cba833
- Enrichment time
- 2026-09-30T08:51:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.