S33K3R (@gr33pp) profile picture

S33K3R

@gr33pp

Curiosity.

 Global
Joined May 2023
  • Tweets299
  • Following105
  • Followers67
35Media
Photo by S33K3R (@gr33pp)Photo by S33K3R (@gr33pp)Photo by S33K3R (@gr33pp)Photo by S33K3R (@gr33pp)Photo by S33K3R (@gr33pp)Photo by S33K3R (@gr33pp)Photo by S33K3R (@gr33pp)Photo by S33K3R (@gr33pp)Photo by S33K3R (@gr33pp)Photo by S33K3R (@gr33pp)
S33K3R retweeted
kmkz (@kmkz_security) profile picture
kmkz
@kmkz_securityApr 16
0day delivery
Image from kmkz (@kmkz_security)
25
80
8
1,344
46,476
HTTP/3 downgrade desync via a QUIC FIN! This is a really nice finding. There used to be a significant cognitive & fiddly-coding barrier to testing lower-level HTTP/2 & 3 techniques but AI has largely eliminated it. As ever, the fix is... upstream HTTP/1 must die!
r3verii (@r3verii) profile picturer3verii@r3veriiApr 16
HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555) r3verii.github.io/cve/2026/0…
HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555)

HAProxy HTTP/3 -> HTTP/1 Desync: Cross-Protocol Smuggling via a Standalone QUIC FIN (CVE-2026-33555)

One zero-byte QUIC packet is enough to desynchronize HAProxy’s backend connection pool and smuggle HTTP requests across unrelated users — even users on a completely different frontend protocol.

r3verii.github.io
5
52
1
388
40,672

No more items