AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
12:09 · August 7, 2026 · Hacker News AI Section
PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle, generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate desync vectors. PortSwigger said a separate human-guided discovery cascade also exposed a zero-day in Apache Traffic Server. Kettle said HTTP Terminator tested 30,000 websites where
Summary
PortSwigger’s HTTP Terminator, developed by James Kettle, is an AI-assisted system that processed 138 HTTP and SMTP RFCs by breaking them into roughly 15,000 fragments. These fragments served as seeds for generating and testing 30,000 candidate desynchronization vectors. The autonomous phase produced several previously undocumented triggers, including a dual-matching Content-Length pattern and a multipart/byteranges technique that affected more than 200 sites in the authorized test set, among them an unnamed U.S. bank.
A key output was the dangling-byte variant of response queue poisoning. By leaving a smuggled request one byte short, the method ensures the second backend response is withheld until a subsequent victim request supplies the missing byte. This removes the timing race that previously limited RQP reliability on many servers and can expose session cookies or API keys belonging to other users.
The same research run surfaced the broader concept of Shared-Parser Confusion, in which servers reuse response-parsing logic for incoming requests. Kettle validated and generalized the idea after the system proposed it. A separate human-guided discovery cascade identified a desynchronization flaw in Apache Traffic Server, later assigned CVE-2026-63078 and patched; public CVE records still lack an entry for the identifier.
When the system scanned 30,000 sites reachable under bug-bounty or disclosure programs, it flagged approximately 700 targets spanning banks, government systems, security products, and an airport. PortSwigger has open-sourced the implementation, which relies on Claude for document extraction and test generation while requiring human oversight for final validation of certain findings. Recommended defenses remain unchanged: remove HTTP/1.1 upstream connections where feasible, or enforce strict method allow-lists at both proxy and origin layers for requests that may carry bodies.
Why it matters
Directly addresses AI-driven discovery of web-security vulnerabilities with clear privacy impact (session cookies, API keys) and actionable defenses relevant to EU/Dutch organizations subject to GDPR and NIS2. Security professionals can test the open-sourced tool and apply the recommended controls to their HTTP infrastructure.
