Comment by cowlevel
20 hours ago
HTTP 1 is full of parser differential vulnerabilities, which 2 fixes. That is probably its biggest flaw.
SMTP is too chatty - it uses too many round trips for efficient transfer across the internet. It can take several seconds just to get to the point of sending the email data. It also duplicates information between the SMTP envelope and the email body which creates vulnerabilities when they don't match.
For APIs that don't have to work in a browser I suggest JSON lines over TCP, or over TLS.
Most header parsing bugs that affect HTTP1.1 can also affect 2+3. Not in the same style but there are quite a few overlapping ones.
Only when 2/3 translates to 1, as in request smuggling attacks at a reverse proxy.