nghttpx HTTP Upgrade + Content-Length Queue Poison Request Smuggling
Detects HTTP/1.1 Upgrade requests directed at an nghttpx proxy that contain a non-zero Content-Length header. This combination is the core primitive for the nghttp2-nghttpx-upgrade-queue-poison-poc attack, where the proxy incorrectly forwards request body bytes to the next backend connection user.
YARA-L
