nghttpx HTTP/1.1 Upgrade with Content-Length body — queue poison smuggling
Detects HTTP requests that include an 'Upgrade' header (specifically for websocket or h2c) in conjunction with a 'Content-Length' header. This combination can be used to perform HTTP Request Smuggling or protocol-specific request queue poisoning attacks, particularly against load balancers or proxy servers like nghttpx.
Splunk (SPL)
