Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
1
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by @fennel ×
  • highPGN-10444

    HTTP/2 to HTTP/1.1 downgrade desync on courier API edge allows request queue poisoning

    A CRLF in an H2 header value survived translation at the edge. Impact was framed as capture of the next researcher-owned request on the same connection.

    Parcelo@fennelHTTP Request Smuggling16 Oct 2026triage 46hresolved 13.3d
    $7,000
    Resolved
Hacktivity
Connecting
  • Bounty paidParcelo@fennel
    HTTP/2 to HTTP/1.1 downgrade desync on courier API edge allows request queue poisoning
    high
    $7,000
All disclosed reports →