Warp versions from 1.3.3 up to but not including 3.4.17 contain multiple HTTP/1.x request parsing flaws that allow HTTP request smuggling. These flaws cause warp to interpret request framing differently than front-end proxies, enabling attackers to bypass access controls, request validation, logging, or WAF rules. The HTTP/2 support is unaffected. Warp 3.4.17 fixes these issues by validating request framing and rejecting ambiguous or malformed requests with appropriate errors.