Yep, the original reports are here: https://hackerone.com/reports/488147 https://hackerone.com/reports/510152

And I posted a full whitepaper/presentation on the technique here: https://portswigger.net/research/http-desync-attacks-request...