RomHack 2025 - James “albinowax” Kettle - HTTP/1.1 Must Die! The Desync Endgame

HTTP/1.1 Desync Endgame

James Kettle revisits four years of HTTP request-smuggling research expecting minor edge cases, but finds the problem worsening. HTTP/1.1 cannot reliably separate requests; tiny parser differences between frontends and backends enable desyncs and often full site takeover.

Industry Response vs Reality

Deploying HTTP/2 upstream was the hoped-for fix, yet many stacks accept H2 from clients then downgrade to H1 toward backends. Vendors added regex blocks that stop scanners and classic probes while leaving vulnerabilities exploitable—creating false confidence Kettle calls the “desync endgame.”

Cloudflare Case Study

A researcher’s smuggling test appeared blocked at Cloudflare’s cache edge yet still desynced inside Cloudflare infrastructure, potentially affecting masses of sites when static GET requests omitted cache busters. Kettle argues proxy chains that convert H2→H1→H2 amplify complexity built on a broken foundation.

Research Agenda

He plans new tooling, additional desync attack classes, and scrutiny of whether H2 truly succeeds H1—arguing upstream HTTP/1.1 must die and be proven insecure to drive change.