News for hackers. Stuff that matters.

A comment on HTTP/1.1 must die: the desync endgame. Parent comment

Re:HTTP/1.1 must die: the desync endgame by Bender on Friday August 15, 2025 @04:14PM (#44916835)
Speaking of http/2 [1] - August 14, 2025

The underlying vulnerability, tracked as CVE-2025-8671, has been found to impact projects and organizations such as AMPHP, Apache Tomcat, the Eclipse Foundation, F5, Fastly, gRPC, Mozilla, Netty, Suse Linux, Varnish Software, Wind River, and Zephyr Project.

[1] - https://www.securityweek.com/madeyoureset-http2-vulnerabilit...

[ Parent | on HN ]
Re:HTTP/1.1 must die: the desync endgame by yencabulator on Monday August 18, 2025 @03:53PM (#44944609)
Protocol smuggling is a lot more severe than DoS.
[ Parent | on HN ]