New CRLF Desync Attack Lets Hackers Steal HTTPOnly Cookies and Hijack Accounts

Gbhackers •Divya • August 20, 2026

Security researchers Tom Stacey from PortSwigger and Tobia Righi from TurtleSec have introduced a new category of HTTP request smuggling attacks known as “CRLF-Powered Desync Attacks.” This method exploits a frequently overlooked HTTP header injection vulnerability, which can lead to full account takeovers, theft of HTTPOnly cookies, and even the creation of self-propagating desync worms. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CRLF-Powered Desync Attacks Enable Account Hijacking and Cookie Theft Security researchers have identified a new category of HTTP request smuggling attacks termed 'CRLF-Powered Desync Attacks.' These attacks exploit a CRLF injection vulnerability, allowing attackers to hijack user accounts and steal HTTPOnly cookies. The method involves improperly handled carriage return and line feed characters in HTTP headers, leading to potential cache poisoning and the delivery of malicious payloads. Affected systems include various web applications that fail to sanitize input properly. The researchers warn that this vulnerability can escalate into self-propagating desynchronization worms. Organizations using vulnerable web applications are at risk of significant data breaches. The attack vector is particularly concerning due to its potential for widespread exploitation. Security teams are advised to review their HTTP header handling practices to mitigate this risk. 2 sources 68

Extracted Entities

Vulnerabilities (1)

HTTP Request Smuggling