“In both the nominations and the final top ten, we saw heavy focus on HTTP Request Smuggling, and attacks on parser inconsistency in general.”
The best attacks of the year mostly exploit two pieces of software that disagree about where a request ends. Every proxy, CDN and load balancer added to the stack is another parser to disagree with. The industry sells those layers as security. The researchers keep proving they are attack surface.