Sanitizing HTTP/1: a technical deep dive into HAProxy's HTX abstraction layer
HTTP/1.1 is a text-based protocol where the message framing is mixed with its semantics, making it easy to parse incorrectly. The boundaries between messages are very weak because there is no clear delimiter between them. Thus, HTTP/1.1 parsers are especially vulnerable to request smuggling attacks.