HackerOne Bug Bounty Reports Highlight Critical HTTP Vulnerabilities

Two recent HackerOne bug bounty reports detail significant vulnerabilities affecting HTTP upload and HTTP/2 connections. The first report, submitted by a user named Anteater, reveals that the HTTP upload resume offset can be consumed twice after an early redirect, potentially allowing attackers to manipulate file uploads. The second report indicates that the CURLOPT_FORBID_REUSE option is silently lost on multiplexed HTTP/2 connections when a transfer finishes first, which could lead to unintended reuse of connections. Both vulnerabilities were reported on September 7, 2026, and could impact applications relying on these protocols. Currently, there is no indication of active exploitation for either vulnerability, but they pose a risk to systems using affected configurations.

Key Points: • Two vulnerabilities reported on HackerOne affecting HTTP upload and HTTP/2 connections. • The first vulnerability allows for potential manipulation of file uploads through early redirects. • The second vulnerability risks unintended connection reuse in HTTP/2, impacting secure communications.