HTTP Terminator: PortSwigger's AI System Finds Novel HTTP Desync Techniques and a 0-Day in Apache

PortSwigger has unveiled HTTP Terminator — an AI-powered research system built by James Kettle. It generated and confirmed new HTTP desynchronization techniques after examining roughly 30,000 possible attack variants. A separate, human-directed line of inquiry exposed a zero-day vulnerability in Apache Traffic Server.

How it worked

Kettle fed the system 138 HTTP and SMTP RFCs, which were split into about 15,000 small fragments and used as inspiration for 30,000 unique candidate vectors. HTTP Terminator then tested 30,000 sites where scanning was permitted under bug bounty and vulnerability disclosure programs, and — before any in-depth verification — found around 700 vulnerable targets, among them banks, government infrastructure, security products and one airport.

The findings include new desync triggers, a double-match pattern on the Content-Length header, and a “dangling-byte” technique. An approach using the Content-Type: multipart/byteranges header worked against several server implementations and affected more than 200 sites, including an unnamed U.S. bank.

Response queue poisoning

Special attention went to response queue poisoning (RQP) — an attack in which the front end loses the correspondence between back-end responses and users and can hand out someone else's response along with session cookies or API keys. Of 16 ideas for improving RQP, only the “dangling-byte” technique survived testing: it leaves the smuggled request one byte short, so the back end's second response isn't produced until the victim's request supplies the missing byte. This eliminates the race condition that has often made RQP unreliable.

The system also proposed a broader concept, Shared-Parser Confusion — where servers reuse parsing logic and response-handling rules are mistakenly applied to requests. The idea was put forward by an automated component, but Kettle himself confirmed and generalized it. “Neither of us would have discovered this alone,” he said. This is exactly where the line of autonomy runs: the system proved some techniques on its own, while the 0-day and Shared-Parser Confusion required a human in the loop.

Apache and gaps in verification

The Apache Traffic Server vulnerability has, the researchers say, already been fixed and assigned the identifier CVE-2026-63078. Yet as of August 7, The Hacker News could find no public record of this CVE in either CVE.org or the NVD, and Apache's July bulletin covering 34 vulnerabilities does not mention it — so the identifier cannot yet be matched to a specific release.

The defensive recommendations remain unchanged: drop HTTP/1.1 on upstream connections where possible, and where that isn't possible, maintain method allow-lists at both tiers and restrict which methods may carry a request body.

PortSwigger has open-sourced HTTP Terminator. The implementation uses Claude to extract data from documents and generate test cases, while the “investigator” stage requires Claude Code. Separately, Kettle tested new models on a rediscovery benchmark and reported a 30% success rate for GPT-5.6 Sol when hinted at the technique.

Source: The Hacker News