PortSwigger's AI-assisted HTTP Terminator discovers new desync techniques and Apache zero-day

AI-Assisted Vulnerability Discovery

PortSwigger announced that its AI-assisted research system, HTTP Terminator, developed by James Kettle, successfully generated and proved new HTTP desynchronization techniques. The system explored 30,000 candidate desync vectors, leading to the discovery of novel attack methods. This demonstrates the capability of AI in identifying complex security vulnerabilities.

New Desync Techniques and RQP Improvements

The research produced new desync triggers, including a dual-matching Content-Length pattern and a "dangling-byte" technique. The dangling-byte method aims to make Response Queue Poisoning (RQP) more reliable by eliminating race conditions. RQP can lead to a front end misattributing back-end responses to users, potentially exposing sensitive data like session cookies or API keys. The system also proposed Shared-Parser Confusion, a broader attack concept that was later validated.

Apache Traffic Server Zero-Day

A separate human-guided discovery process, stemming from the research, exposed a zero-day vulnerability in Apache Traffic Server. This issue has reportedly been patched and assigned CVE-2026-63078. However, public records for this CVE were not found on CVE.org or NVD as of August 7, and it was not listed in Apache's July advisory.

Real-World Impact and Recommendations

HTTP Terminator tested 30,000 authorized websites, identifying approximately 700 vulnerable targets across various sectors, including banks, government infrastructure, security products, and an airport. PortSwigger recommends avoiding HTTP/1.1 upstream where possible. If HTTP/1.1 must be used, they advise allow-listing methods at both layers and restricting which methods can carry request bodies to mitigate desynchronization risks.