HTTP/2 to HTTP/1 downgrade request smuggling
Front ends that translate HTTP/2 to HTTP/1 can be desynced by smuggling a Content-Length or CRLF the rewriter trusts.
Tag: request-smuggling
Detect CL.TE request smuggling without breaking the app
A timing-safe CL.TE probe confirms desync by making the front end wait for a body the back end already considers finished.