← Leaderboard
#10 · 90 days#20 · all timeRising
@fennel
🇮🇪member since 12 Jan 2025·Request smuggling · HTTP/2
Reputation
5,320
Signal
7.5
avg severity of valid reports
Impact
30.4
bounty-weighted
Earned, 90d
$38k
Earned, all time
$96k
Valid reports
31
10-week streak
Disclosed reports · 1
$7,000 shown- highPGN-10444
HTTP/2 to HTTP/1.1 downgrade desync on courier API edge allows request queue poisoning
A CRLF in an H2 header value survived translation at the edge. Impact was framed as capture of the next researcher-owned request on the same connection.
$7,000Resolved
Programs
Portable record
Every outcome on this profile is signed by the program that decided it. Export the record and verify it anywhere.
pgn record export @fennel --sign