HTTP duplicate Content-Length header - request smuggling primitive

Ali AlEnezi@site

•updated Sep 15, 2026•0•0•1

This rule detects HTTP requests that contain duplicate 'Content-Length' headers, a technique used to perform HTTP Request Smuggling attacks. Attackers exploit discrepancies in how front-end and back-end servers interpret duplicate or conflicting request headers to smuggle requests, bypass security controls, or gain unauthorized access to back-end systems.