A desynchronization zero-day in Apache Traffic Server was exposed during human-guided research by PortSwigger. The issue has been patched, but public records do not yet map the CVE to a specific fixed release, leaving a verification gap for defenders.