HTTP request smuggling is an attack where a malicious user sends a specially crafted HTTP request that gets interpreted as two separate requests by the server. This can expose internal server endpoints and lead to unauthorized access.