Classic Load Balancer mitigates desync attacks

Check ID: elb_desync_mitigation_mode
Provider: AWS
Service: elb
Severity: MEDIUM
Resource type: AwsElbLoadBalancer

What this check verifies

Classic Load Balancer desync_mitigation_mode is evaluated to determine whether it is configured as defensive or strictest. Any other mode (such as monitor) is identified for attention.

Risk

Without strict desync mitigation, HTTP request smuggling can occur, enabling:

Cache/queue poisoning (integrity)
Session hijacking and data exposure (confidentiality)
Unintended backend actions and abuse (availability)

Recommendation

Set CLB desync mitigation to defensive or, where compatible, strictest. Validate in staging to avoid client breakage. Apply defense in depth: enforce strict header handling, pair with WAF controls, and monitor non-compliant request indicators.

Remediation

CLI
Terraform
Dashboard steps

aws elb modify-load-balancer-attributes --load-balancer-name <load-balancer-name> --load-balancer-attributes '{"AdditionalAttributes":[{"Key":"elb.http.desyncmitigationmode","Value":"defensive"}]}'

resource "aws_elb" "<example_resource_name>" {
  name               = "<example_resource_name>"
  availability_zones = ["<example_az>"]

  listener {
    instance_port     = 80
    instance_protocol = "http"
    lb_port           = 80
    lb_protocol       = "http"
  }

  desync_mitigation_mode = "defensive" # Critical: sets CLB desync mitigation to defensive to pass the check
}

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elb_desync_mitigation_mode. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Classic Load Balancer has cross-zone load balancing enabled Load Balancer HTTPS listeners use a secure SSL policy

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires