# AI-Assisted "HTTP Terminator" Uncovers Novel HTTP Desync Techniques and Apache Traffic Server Zero-Day (CVE-2026-63078)

> PortSwigger Director of Research James Kettle built HTTP Terminator, an AI-assisted research pipeline that ingested 138 HTTP/SMTP RFCs, fragmented them into ~15,000 micro-inspirations, and generated 30,000 candidate HTTP desynchronization vectors tested against 30,000 authorized bug-bounty sites. The system surfaced novel desync classes (dual-matching Content-Length, a dangling-byte response-queue-poisoning reliability trick, Shared-Parser Confusion, a Content-Type: multipart/byteranges trigger, status-line injection, and range cache poisoning) and, via human-guided follow-up, a zero-day desync flaw in Apache Traffic Server (CVE-2026-63078), since patched. Validation found roughly 700 vulnerable targets among the 30,000 tested, including a U.S. bank, a .gov site, an airport (via F5 BIG-IP), and Meta, Citrix NetScaler, and Microsoft Azure Application Gateway deployments.

- **Published:** 2026-08-09T00:00:00Z
- **Last reviewed:** 2026-08-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1961
- **ID:** TL-2026-1961
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-63078

## Description

HTTP Terminator is an AI-assisted vulnerability-research pipeline built by PortSwigger Director of Research James Kettle, with collaborators Paolo 'sw33tLie' Arnolfo and Francesco 'Medusa' Mariani, and publicly released on GitHub (PortSwigger/http-terminator) under AGPL-3.0. The pipeline runs a four-stage cascade — Seeker (Python, uses Claude to extract candidate techniques from RFC text), Flamer (Java/Gradle, generates malformed HTTP test cases), Validator (a Burp Suite extension that tests generated requests against live, authorized targets), and Investigator (Python, uses Claude Code plus an MCP simulator and Burp Organizer to replicate and confirm findings) — conceptually described by PortSwigger as Ideation, Evaluation, Weaponization, and Cascade. The system ingested 138 HTTP and SMTP RFCs, fragmented them into roughly 15,000 one-to-three-sentence 'micro-inspiration' chunks (deliberately avoiding the words 'desync' and 'smuggling' to maximize novelty), and produced 30,000 unique candidate desync vectors after deduplication, each fragment yielding one to five candidate requests to limit context contamination. These vectors were validated against 30,000 real, authorized-scope bug-bounty targets.

The research produced several genuinely novel desync technique classes. Dual-matching Content-Length abuses servers that treat two identical, duplicated Content-Length headers as signaling a zero-length body, letting a second smuggled request ride through undetected (observed against an SSO endpoint and a Meta server). The dangling-byte technique deliberately leaves a smuggled request exactly one byte short so the back-end withholds its second response until a genuine victim request arrives — this was the only survivor of 16 reliability concepts evaluated for response-queue poisoning (RQP), eliminating the race conditions that normally make RQP unreliable. A Content-Type: multipart/byteranges trigger misapplies RFC 9112 §6.1 response-framing rules to a request, and alone affected 200+ sites including an American bank. Shared-Parser Confusion, a concept proposed by the AI system and then manually validated by Kettle, exploits servers that reuse the same parsing logic for both requests and responses, letting response-only directives (such as Set-Cookie handling) be triggered via crafted request headers. Two further techniques were documented: status-line injection, where an unsanitized protocol string is copied verbatim into a back-end response status line and breaks front-end response buffering (observed against a redacted bank), and range cache poisoning, where a manipulated range request causes an origin to return HTTP 200 instead of 206 Partial Content, causing a shared cache to store and later serve an incomplete response as the complete resource.

Human-guided follow-up on a malformed-request cascade led to a zero-day desync flaw in Apache Traffic Server, tracked as CVE-2026-63078. The trigger combines a DELETE request carrying a Content-Location header and Max-Forwards: 0 with a trailing, smuggled TRACE request; the flaw was confirmed when injected inline headers reappeared inside the server's response. The vendor patched the issue prior to PortSwigger's public disclosure. Notably, as of the article's 7 August 2026 publication no public CVE record existed for CVE-2026-63078 at CVE.org or NVD, and it is NOT among the 34 CVEs Apache Traffic Server addressed in its July 2026 9.2.15/10.1.4 security release (which covered unrelated use-after-free, HostDB memory-leak, and prefetch-plugin issues) — leaving the affected-version range for this specific desync flaw publicly undocumented at time of writing.

Beyond the single confirmed Apache CVE, deeper validation against the full 30,000-site pool found roughly 700 vulnerable targets spanning banking, government, security-product, and airport/transportation infrastructure. Named product exposures during testing included F5 BIG-IP (an airport target), Citrix NetScaler (a bank misconfiguration), Microsoft Azure Application Gateway (via an Early-Data header trigger), Akamai (in an Apache-proxy scenario), and BeyondTrust Secure Remote Access (a CONNECT-request flaw, which prompted BeyondTrust to inquire about the replication methodology). PortSwigger published the research as 'Can AI do novel security research? Meet the HTTP Terminator' on 5 August 2026 (updated 6 August), tied to Black Hat USA 2026 / DEF CON 34, and simultaneously open-sourced HTTP Terminator alongside updates to three existing Burp tools: HTTP Request Smuggler (new vectors plus contamination detection), Turbo Intruder (a new MCP interface for autonomous exploitation), and Param Miner (a new protocol-ruler header-analysis technique). The AI models struggled with autonomous exploitation of RQP without human guidance, producing false positives around HTTP pipelining, and a retrospective rediscovery benchmark found only a 30% success rate when a separate model (GPT-5.6 Sol) was given the same inspiration techniques — underscoring that human validation remained essential to turning the system's proposals into confirmed findings such as Shared-Parser Confusion and the Apache zero-day.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1588.006 Vulnerabilities
- T1587.004 Exploits
- T1190 Exploit Public-Facing Application
- T1027 Obfuscated Files or Information
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1565.002 Transmitted Data Manipulation
- T1499.004 Application or System Exploitation

## Sources

- [AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day](https://thehackernews.com/2026/08/ai-assisted-http-terminator-finds-novel.html)
- [Can AI do novel security research? Meet the HTTP Terminator](https://portswigger.net/research/http-terminator)
- [Apache Traffic Server (official project site)](https://trafficserver.apache.org/)
- [PortSwigger/http-terminator](https://github.com/PortSwigger/http-terminator)
- [PortSwigger/http-request-smuggler](https://github.com/PortSwigger/http-request-smuggler)
- [PortSwigger/turbo-intruder](https://github.com/PortSwigger/turbo-intruder)
- [PortSwigger/param-miner](https://github.com/PortSwigger/param-miner)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1961