HTTP Terminator AI Uncovers New Desync Attacks and Apache Zero-Day

PortSwigger has disclosed that HTTP Terminator, an AI-assisted research system built by James Kettle, director of research at PortSwigger, generated and validated novel HTTP request smuggling techniques after exploring 30,000 candidate desynchronization vectors. In parallel, a human-guided discovery cascade exposed a zero-day vulnerability in Apache Traffic Server, now tracked as CVE-2026-63078. The findings were tested against 30,000 websites participating in bug bounty and vulnerability disclosure programs, identifying roughly 700 vulnerable targets spanning banks, government infrastructure, security vendors, and an airport.

The research produced new desync triggers, including a dual-matching Content-Length pattern and a "dangling-byte" technique designed to make response queue poisoning (RQP) more reliable. RQP can cause a front-end proxy to lose track of which back-end response belongs to which user, potentially exposing another user's session cookies, API keys, or sensitive payloads. The team also disclosed Shared-Parser Confusion, a broader attack class that HTTP Terminator proposed but Kettle validated and generalized. Defenders are urged to avoid HTTP/1.1 upstream connections where possible, allow-list HTTP methods at both proxy and origin layers, and restrict which methods may carry request bodies.

Technically, Kettle fed HTTP Terminator 138 HTTP and SMTP RFCs, which were split into roughly 15,000 fragments and used as inspiration to generate the 30,000 candidate vectors. A Content-Type: multipart/byteranges trigger worked across multiple server implementations and exposed more than 200 sites in the test set, including a major U.S. bank. Of 16 ideas tested for strengthening RQP, only the dangling-byte technique survived evaluation; it deliberately leaves a smuggled request one byte short so the second back-end response is withheld until a victim request supplies the missing byte, eliminating the race condition that has historically made RQP unreliable. In the human-led chain, a malformed request ultimately triggered the Apache Traffic Server zero-day, which has since been patched, though The Hacker News noted that CVE-2026-63078 could not yet be mapped to a specific fixed release via CVE.org or NVD as of August 7.

Organizations operating reverse proxies or origin servers should review their exposure to HTTP desync attacks using tools like a SSL/TLS checker to validate upstream connections and a privacy checkup to identify potential data leakage points. Because RQP can surface session cookies and API keys from other users, security teams should also consider running an email breach checker to confirm whether any exposed credentials have already surfaced in known leaks.