HTTP invalid Transfer-Encoding value - desync primitive
This rule detects HTTP requests containing an invalid or malformed 'Transfer-Encoding' header value. Such malformations are often used in HTTP Request Smuggling (HRS) attacks to cause desynchronization between a front-end load balancer/proxy and a back-end web server, potentially allowing an attacker to smuggle requests, bypass security controls, or perform cache poisoning.
Suricata
