Chunk Ext CR — Request Smuggling
| Test ID | SMUG-CHUNK-EXT-CR |
| Category | Smuggling |
| RFC | RFC 9112 §7.1.1, RFC 9112 §2.2 |
| Requirement | MUST reject malformed chunk line |
| Expected | 400 or close |
What it sends
A chunk-size line where a bare CR appears inside the extension area, not as a valid CRLF terminator.
POST / HTTP/1.1\r\n
Host: localhost:8080\r\n
Transfer-Encoding: chunked\r\n
\r\n
5;a\rX\r\n
hello\r\n
0\r\n
\r\n
Why it matters
Differential handling of bare CR in framing metadata can produce parser disagreement across hops and create desync risk.
Sources
Http11Probe — HTTP/1.1 compliance & smuggling testerSource on GitHub