AI-Assisted HTTP Terminator Uncovers Novel HTTP Desync Techniques and Apache Zero-Day

PortSwigger’s AI-assisted research system, HTTP Terminator, has generated and proven new HTTP desynchronization techniques after exploring 30,000 candidate attack vectors. The system, built by James Kettle, tested 30,000 websites authorized for scanning through bug bounty or vulnerability disclosure programs, finding roughly 700 vulnerable targets. These included banks, government infrastructure, security products, and an airport.

The research produced new desync triggers, a dual-matching Content-Length pattern, and a ‘dangling-byte’ technique designed to make response queue poisoning (RQP) more reliable. RQP can potentially cause a front end to lose track of which back-end response belongs to which user, potentially exposing another user’s response, including session cookies or API keys. The researchers also disclosed Shared-Parser Confusion, a broader attack concept proposed by the system and validated by Kettle.

In the human-guided cascade, a malformed request exposed a desynchronization zero-day in Apache Traffic Server, tracked as CVE-2026-63078. The issue has been patched, but a verification gap remains as public records do not yet map the CVE to a specific fixed release. PortSwigger recommends avoiding HTTP/1.1 upstream where possible, and if not, allow-listing methods at both layers and restricting which methods may carry request bodies.

HTTP Terminator has been open-sourced, using Claude for document extraction and test-case generation, with its investigator stage requiring Claude Code. Researchers also released public tools for studying CRLF-powered desync attacks, including crlf-desyncs and crlf-powered-desync-scanner. Kettle separately tested newer models on a rediscovery benchmark, reporting a 30% success rate for GPT-5.6 Sol.