nghttpx HTTP/1.1 Upgrade Queue Poisoning - Request Smuggling via Content-Length
Detects potential HTTP Request Smuggling attempts targeting nghttpx proxies. The rule monitors for malicious request patterns involving HTTP/1.1 Upgrade headers combined with a body (Content-Length) designed to poison the request queue, as well as specific path patterns (e.g., /upgrade, /poisoned) or server-agent identification of the nghttp2/nghttpx service.
Cortex XDR
