PortSwigger’s AI-assisted research system, HTTP Terminator, has identified novel HTTP desynchronization techniques and uncovered a zero-day vulnerability in Apache Traffic Server. Developed by James Kettle, HTTP Terminator analyzed 30,000 candidate attack vectors, leading to significant findings in web security.
HTTP desynchronization attacks exploit inconsistencies in how front-end and back-end servers handle HTTP requests, potentially allowing attackers to manipulate web traffic and access unauthorized data. By testing 30,000 websites authorized through bug bounty and vulnerability disclosure programs, HTTP Terminator identified approximately 700 vulnerable targets, including banks, government infrastructure, security products, and an airport.
The research introduced new desynchronization triggers, such as a dual-matching Content-Length pattern and a “dangling-byte” technique. The latter enhances the reliability of response queue poisoning (RQP) attacks by leaving a smuggled request one byte short, causing the back-end server to await the missing byte from a victim’s request. This method eliminates race conditions that previously made RQP attacks less dependable.
Additionally, the study revealed a broader attack concept termed Shared-Parser Confusion. This occurs when servers reuse parsing logic for both requests and responses, leading to misapplied processing rules. While HTTP Terminator proposed this concept, Kettle validated and generalized it, highlighting the collaborative nature of AI and human expertise in cybersecurity research.
During a human-guided exploration, a malformed request exposed a zero-day vulnerability in Apache Traffic Server, now tracked as CVE-2026-63078. Although this issue has been patched, as of August 7, 2026, there is no public record of CVE-2026-63078 on CVE.org or NVD, and Apache’s July advisory does not list it. This absence leaves a verification gap for defenders seeking to map the CVE to a specific fixed Traffic Server release.
PortSwigger recommends mitigating these vulnerabilities by avoiding HTTP/1.1 upstream connections. If removal isn’t feasible, they advise allow-listing methods at both layers and restricting which methods may carry request bodies to enhance security.
HTTP Terminator’s development involved feeding it 138 HTTP and SMTP RFCs, which were divided into approximately 15,000 fragments. These fragments inspired the generation of 30,000 unique candidate vectors. Notably, a Content-Type: multipart/byteranges technique proved effective across multiple server implementations, exposing over 200 websites, including a U.S. bank.
PortSwigger has open-sourced HTTP Terminator, allowing the cybersecurity community to further explore and build upon these findings. The released implementation utilizes Claude for document extraction and test-case generation, while its investigator stage requires Claude Code.
These advancements underscore the growing role of AI in cybersecurity research. By automating the discovery of complex vulnerabilities, AI tools like HTTP Terminator enable more efficient identification and mitigation of security threats. However, the collaboration between AI systems and human researchers remains crucial, as demonstrated by the validation and generalization of Shared-Parser Confusion and the identification of the Apache zero-day vulnerability.
