CRLF-Powered Desync Attacks: Beheading HTTP Streams

HTTP header injection has been under-rated for twenty years. This research shows how one injected CRLF sequence in an Nginx-normalised path escalates into the full desync arsenal — response queue poisoning, CL.TE and 0.CL smuggling, cache poisoning and request tunnelling — and ultimately into a self-replicating CRLF-powered desync worm. It also introduces novel techniques for connection-locked and…