A SANS Internet Storm Centre test has highlighted differing behaviour among web servers when a GET request includes a body. The experiment, published on 22 September 2026 by Johannes Ullrich, followed discussion of the newly introduced HTTP Query method, which is intended to support requests resembling GET while carrying body data.
Apache 2.4.68, tested on a Mac, accepted a GET request containing `Content-Length: 6` and the body `TEST`. It returned `HTTP/1.1 200 OK`, and a modified CGI test script reported both `CONTENT_LENGTH = 6` and `BODY = TEST`, showing that the body reached the application. NGINX also did not reject the request, but began responding after receiving the headers and ignored the body; the example returned `301 Moved Permanently`.
Python’s basic server, run with `python -m http.server 8000`, appeared to behave similarly to NGINX: it returned a response, with status 200, while ignoring the body.
The observations demonstrate that handling of GET bodies is not consistent across implementations. The article does not report exploitation or identify a specific security flaw, but the differences could matter when systems interpret requests in different ways. Ullrich invited readers to test other web servers and compare their responses.