AI-Assisted "HTTP Terminator" Uncovers Novel HTTP Desync Techniques and Apache Traffic Server Zero-Day (CVE-2026-63078) — Threadlinqs Intelligence
As of 2026-08-09, AI-Assisted "HTTP Terminator" Uncovers Novel HTTP Desync Techniques and Apache Traffic Server Zero-Day (CVE-2026-63078) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 10 indicators of compromise.
Threat ID: TL-2026-1961 · Severity: HIGH · Status: ACTIVE · Category: VULNERABILITY
PortSwigger Director of Research James Kettle built HTTP Terminator, an AI-assisted research pipeline that ingested 138 HTTP/SMTP RFCs, fragmented them into ~15,000 micro-inspirations, and generated
HTTP Terminator is an AI-assisted vulnerability-research pipeline built by PortSwigger Director of Research James Kettle, with collaborators Paolo 'sw33tLie' Arnolfo and Francesco 'Medusa' Mariani, and publicly released on GitHub (PortSwigger/http-terminator) under AGPL-3.0. The pipeline runs a four-stage cascade — Seeker (Python, uses Claude to extract candidate techniques from RFC text), Flamer (Java/Gradle, generates malformed HTTP test cases), Validator (a Burp Suite extension that tests generated requests against live, authorized targets), and Investigator (Python, uses Claude Code plus an MCP simulator and Burp Organizer to replicate and confirm findings) — conceptually described by PortSwigger as Ideation, Evaluation, Weaponization, and Cascade. The system ingested 138 HTTP and SMTP RFCs, fragmented them into roughly 15,000 one-to-three-sentence 'micro-inspiration' chunks (deliberately avoiding the words 'desync' and 'smuggling' to maximize novelty), and produced 30,000 unique candidate desync vectors after deduplication, each fragment yielding one to five candidate requests to limit context contamination. These vectors were validated against 30,000 real, authorized-scope bug-bounty targets.
The research produced several genuinely novel desync technique classes. Dual-matching Content-Length abuses servers that treat two identical, duplicated Content-Length headers as signaling a zero-length body, letting a second smuggled request ride through undetected (observed against an SSO endpoint and a Meta server). The dangling-byte technique deliberately leaves a smuggled request exactly one byte short so the back-end withholds its second response until a genuine victim request arrives — this was the only survivor of 16 reliability concepts evaluated for response-queue poisoning (RQP), eliminating the race conditions that normally make RQP unreliable. A Content-Type: multipart/byteranges trigger misapplies RFC 9112 §6.1 response-framing rules to a request, and alone affected 200+ sites including an American bank. Shared-Parser Confusion, a concept proposed by the AI system and then manually validated by Kettle, exploits servers that reuse the same parsing logic for both requests and responses, letting response-only directives (such as Set-Cookie handling) be triggered via crafted request headers. Two further techniques were documented: status-line injection, where an unsanitized protocol string is copied verbatim into a back-end response status line and breaks front-end response buffering (observed against a redacted bank), and range cache poisoning, where a manipulated range request causes an origin to return HTTP 200 instead of 206 Partial Content, causing a shared cache to store and later serve an incomplete response as the complete resource.
Human-guided follow-up on a malformed-request cascade led to a zero-day desync flaw in Apache Traffic Server, tracked as CVE-2026-63078. The trigger combines a DELETE request carrying a Content-Location header and Max-Forwards: 0 with a trailing, smuggled TRACE request; the flaw was confirmed when injected inline headers reappeared inside the server's response. The vendor patched the issue prior to PortSwigger's public disclosure. Notably, as of the article's 7 August 2026 publication no public CVE record existed for CVE-2026-63078 at CVE.org or NVD, and it is NOT among the 34 CVEs Apache Traffic Server addressed in its July 2026 9.2.15/10.1.4 security release (which covered unrelated use-after-free, HostDB memory-leak, and prefetch-plugin issues) — leaving the affected-version range for this specific desync flaw publicly undocumented at time of writing.
Beyond the single confirmed Apache CVE, deeper validation against the full 30,000-site pool found roughly 700 vulnerable targets spanning banking, government, security-product, and airport/transportation infrastructure. Named product exposures during testing included F5 BIG-IP (an airport target), Citrix NetScaler (a bank misconfigur
Weaknesses (CWE)
CWE-444, CWE-436
Target sectors: financial services, government administration, aviation, critical infrastructure, technology, cybersecurity vendors
Target regions: united states of america, Global
Timeline
- PortSwigger publishes 'Can AI do novel security research? Meet the HTTP Terminator,' detailing the AI-assisted desync-discovery methodology, the 700/30,000 vulnerable-site validation results, and CVE-2026-63078 as already patched.
- James Kettle discloses that HTTP Terminator's human-guided cascade uncovered a zero-day HTTP desync flaw in Apache Traffic Server (CVE-2026-63078), triggered by a DELETE request with a Content-Location header and a smuggled TRACE request, patched by the vendor prior to publication.
- PortSwigger open-sources HTTP Terminator on GitHub and ships updated releases of HTTP Request Smuggler, Turbo Intruder (new MCP interface), and Param Miner (new protocol-ruler technique).
- PortSwigger updates the HTTP Terminator research write-up (14:59 UTC).
- The Hacker News publishes coverage of the HTTP Terminator research and the Apache Traffic Server zero-day.
- As of this date, no public CVE record for CVE-2026-63078 exists at CVE.org or NVD, and it is absent from Apache Traffic Server's July 2026 9.2.15/10.1.4 security release covering 34 unrelated CVEs, leaving the affected-version range for the desync flaw undocumented publicly.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 10 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-63078, T1595.002, T1592.002, T1588.006, T1587.004, T1190, T1027, T1557, T1539, T1119, T1071.001
