Typical severity: High. Likelihood of attack: Medium. An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to split a single HTTP request into multiple unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server). See CanPrecede relationships for possible consequences.
Design: evaluate HTTP agents prior to deployment for parsing/interpretation discrepancies. | Configuration: front-end HTTP agents notice ambiguous requests. | Configuration: back-end HTTP agents reject ambiguous requests and close the network connection. | Configuration: Disable reuse of back-end connections. | Configuration: Use HTTP/2 for back-end connections.