---
title: "Post Mortem: HTTP Request Smuggling Vulnerability"
url: https://daily.dev/posts/post-mortem-http-request-smuggling-vulnerability-36fsdzezd
source_url: https://crystal-lang.org/2026/05/26/http-request-smuggling-vulnerability-in-http-server
type: article
source: "Crystal"
published: 2026-05-29T19:25:26.927Z
updated: 2026-05-29T19:25:49.592Z
tags: ["security"]
reading_time: 4
upvotes: 7
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Post Mortem: HTTP Request Smuggling Vulnerability

**[Crystal](https://daily.dev/sources/crystallang)** · 4 min read · 7 upvotes · 0 comments

## Summary

A post-mortem of an HTTP request smuggling vulnerability discovered in Crystal's HTTP::Server. The root cause was the HTTP request parser prioritizing Content-Length over Transfer-Encoding, violating RFC 9112. This allowed attackers to inject arbitrary HTTP requests between a reverse proxy and the Crystal server, potentially bypassing authentication or access controls enforced at the proxy layer. The fix — rejecting requests with both headers and prioritizing Transfer-Encoding — was shipped in Crystal 1.20.0 and backported to 1.19.2. The practical risk was assessed as low since exploitation required a non-compliant proxy. Key lessons include the importance of RFC compliance and understanding vulnerability chains across multiple software components.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://crystal-lang.org/2026/05/26/http-request-smuggling-vulnerability-in-http-server>

## Similar posts on daily.dev

- [The Most Overlooked Vulnerability — Http request Smuggling](https://daily.dev/posts/the-most-overlooked-vulnerability-http-request-smuggling-bkxsg4njj) · InfoSec Write-ups · 0 upvotes · 0 comments
- [Crystal 1.19.2 is released\!](https://daily.dev/posts/crystal-1-19-2-is-released--kdscgsowv) · Crystal · 0 upvotes · 0 comments
- [Understanding the worst .NET vulnerability ever: request smuggling and CVE-2025-55315](https://daily.dev/posts/understanding-the-worst-net-vulnerability-ever-request-smuggling-and-cve-2025-55315-qljqff7f0) · .NET Escapades · 8 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security)

[View this post on daily.dev](https://daily.dev/posts/post-mortem-http-request-smuggling-vulnerability-36fsdzezd)