Cybersecurity glossary
What is HTTP Request Splitting?
Learn what HTTP request splitting is, how attackers inject extra requests into a stream, how it relates to smuggling and header injection, and which parsing defenses stop desynchronization.
Definition
HTTP request splitting is an attack technique in which crafted input causes a client, proxy, or server to interpret one network stream as multiple HTTP requests, enabling request smuggling-style desynchronization, cache poisoning, or unauthorized backend actions.
Why HTTP request splitting matters
Modern web stacks are rarely one process. A CDN speaks to a WAF, which speaks to a load balancer, which speaks to an origin. Each component parses HTTP. If they disagree about where a request ends, attackers can hide a second request that only one layer understands.
HTTP request splitting exploits that disagreement. The impact is often disproportionate to the bug’s apparent simplicity: security filters see a benign request while the origin executes a privileged one, or a cache stores a poisoned response for other users.
How request splitting works
Identify a parsing boundary
Find proxies, WAFs, or app code that builds or forwards HTTP/1.1 messages.
Inject structural characters
Use CRLF sequences or conflicting length fields to create an extra request in the stream.
Cause frontend/backend disagreement
One component consumes bytes as body; another treats them as a new request start.
Queue a hidden request
The leftover request sits ready to attach to the next user’s connection or to hit an internal route.
Capture the effect
Observe cache poison, auth bypass, or unexpected backend behavior confirming desync.
Normalize and harden
Fix parsers, reject ambiguity, and ensure a single HTTP semantics authority at the edge.
Typical impacts
Cache poisoning
A split request makes a shared cache store attacker content under a popular URL.
Security control bypass
WAFs allow a harmless-looking first request while origins honor a smuggled second request.
Credential/session capture
Desynced pipelines can append victim requests to attacker-controlled prefixes.
Internal route access
Hidden requests target admin or debug endpoints not meant to be directly reachable.
Splitting vs header injection vs smuggling
| Term | Primary focus |
|---|---|
| HTTP header injection | Untrusted data inserts new headers into a message the app constructs |
| HTTP request splitting | One stream is interpreted as multiple requests |
| HTTP request smuggling | Intermediary/origin disagreement, often via CL/TE conflicts |
Prevention checklist
- Reject CR/LF and other control characters in values used to construct HTTP requests or headers.
- Configure reverse proxies to reject requests with both Content-Length and Transfer-Encoding ambiguities.
- Prefer HTTP/2 end-to-end where practical, but harden HTTP/1.1 translation points carefully.
- Keep CDNs, WAFs, and origin servers patched for known desync CVEs.
- Normalize incoming requests once at a trusted edge before application logic sees them.
- Avoid building raw HTTP with string concatenation in application code.
- Include desync tests in authorized penetration tests that exercise the real edge path.
- Monitor for anomalous chained requests, unexpected internal route hits, and cache integrity failures.
The practical takeaway
HTTP request splitting turns parser disagreement into a security boundary failure. When two systems share a TCP stream but not a definition of “one request,” attackers insert a second message that only one side enforces rules on.
Make parsing strict and consistent, reject protocol metacharacters in untrusted input, and treat your CDN-to-origin path as a single security-critical parser chain.
Related security terms
HTTP Header Injection
CRLF injection into headers that can enable splitting-style message manipulation.
Web Application Firewall (WAF)
An intermediary whose parsers must agree with upstream servers on request boundaries.
HTTP/2
A framing protocol that changes how request boundaries are expressed versus HTTP/1.1.
Open Redirect
Sometimes combined with splitting to steer victims through malicious flows.
Frequently asked questions
What is HTTP request splitting in simple terms?
Request splitting tricks part of the HTTP stack into seeing two requests where only one was intended. Attackers insert extra request text so a proxy and a server disagree about where one message ends.
How is request splitting related to HTTP request smuggling?
They overlap heavily. Smuggling usually emphasizes conflicting Content-Length and Transfer-Encoding parsing between intermediaries. Splitting often emphasizes injected request lines/headers via CRLF or unsafe concatenation. Both create desynchronization.
What can attackers do with request splitting?
Poison caches, bypass security controls, hijack credentials from other users’ requests, reach internal admin routes, or cause unexpected backend actions.
Does HTTP/2 eliminate these attacks?
HTTP/2’s binary framing reduces classic HTTP/1.1 ambiguity, but downgrade paths, translation at gateways, and HTTP/1.1 origins can reintroduce desync risks.
Where do splitting bugs come from?
Unsafe construction of requests from user input, inconsistent proxy normalization, and lenient parsers that accept malformed header or body boundaries.
How do you prevent HTTP request splitting?
Reject CR/LF in untrusted values used to build HTTP messages, normalize requests at a single trusted edge, disallow ambiguous Transfer-Encoding/Content-Length combinations, and keep proxies patched.
How should teams test for it?
Authorized tests send malformed and dual-length requests through the real CDN/WAF/origin path and look for desynchronized behavior—never against third-party systems without permission.
References
Explore authoritative guidance and frameworks related to http request splitting.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.