HTTP desynchronization is a parsing flaw where two or more HTTP components disagree about where one request ends and the next begins. A front-end proxy, cache, load balancer, or backend server may interpret the same bytes differently because of conflicting rules for headers, content length, chunked encoding, or malformed requests.
This matters because the disagreement can be turned into request smuggling, cache poisoning, or traffic confusion. An attacker may hide a second request inside what another component thinks is a single message, causing one system to forward or cache data that another never intended to process. Defenders look for it by testing request handling across every hop, comparing parser behavior, and rejecting ambiguous framing. Consistent normalization and strict protocol validation are key controls.