Full Report
PortSwigger says HTTP Terminator, an artificial intelligence (AI)-assisted research system built by James Kettle, generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate attack vectors. PortSwigger said a separate human-guided discovery cascade also exposed a zero-day in Apache Traffic Server. Kettle said HTTP Terminator tested 30,000 websites where scanning
Analysis Summary
# Vulnerability: Novel HTTP Desynchronization and Response Queue Poisoning (RQP)
## CVE Details
- **CVE ID:** CVE-2026-63078 (Specific to Apache Traffic Server)
- **CVSS Score:** Not yet assigned (NVD/CVE record pending as of August 2026)
- **CWE:** CWE-444 (Inconsistent Interpretation of HTTP Requests/'HTTP Desync')
## Affected Systems
- **Products:**
- Apache Traffic Server (ATS)
- Various web servers and proxies supporting HTTP/1.1
- Multiple bank, government, and infrastructure websites (unnamed)
- **Versions:** Apache Traffic Server (Versions prior to the August 2026 patch)
- **Configurations:** Environments utilizing HTTP/1.1 for upstream communication between a front-end proxy and a back-end server.
## Vulnerability Description
Research conducted via the "HTTP Terminator" AI system identified several novel desynchronization techniques:
1. **Dangling-Byte Technique:** A method to make Response Queue Poisoning (RQP) reliable by leaving a smuggled request one byte short. The second back-end response is delayed until a victim's request supplies the missing byte, removing the race condition typically associated with RQP.
2. **Shared-Parser Confusion:** A flaw where response-processing rules are incorrectly applied to requests because the server reuses the same parsing logic for both incoming and outgoing traffic.
3. **Multipart/Byteranges Exploitation:** Use of the `Content-Type: multipart/byteranges` header to trigger desynchronization across multiple server implementations.
## Exploitation
- **Status:** PoC available; validated against 30,000 targets with ~700 vulnerable instances found.
- **Complexity:** Medium (requires specific header manipulation and timing).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Potential exposure of other users' session cookies, API keys, and private responses).
- **Integrity:** Medium (Ability to poison the response queue and redirect content).
- **Availability:** Low.
## Remediation
### Patches
- **Apache Traffic Server:** Apply the latest security updates released in August 2026 to address CVE-2026-63078.
### Workarounds
- **Disable HTTP/1.1 Upstream:** PortSwigger recommends avoiding the use of HTTP/1.1 for communications between the front-end and back-end; use HTTP/2 or HTTP/3 instead.
- **Protocol Strictness:** If HTTP/1.1 is required, implement strict allow-listing of methods at both the front-end and back-end layers.
- **Body Restrictions:** Restrict which HTTP methods are permitted to carry request bodies to prevent smuggling.
## Detection
- **Indicators of Compromise:** Unusual discrepancies between `Content-Length` and `Transfer-Encoding` headers in logs; unexpected 404 or 405 errors for legitimate users (symptom of RQP).
- **Detection Methods and Tools:**
- **HTTP Terminator:** Open-source tool released by PortSwigger for testing desync vectors.
- **crlf-desyncs / crlf-powered-desync-scanner:** Community tools for studying CRLF-based desynchronization.
## References
- **PortSwigger Research:** hxxps[://]portswigger[.]net/research/can-ai-do-novel-security-research
- **GitHub Repository:** hxxps[://]github[.]com/PortSwigger/http-terminator
- **Apache Traffic Server Security:** hxxps[://]trafficserver[.]apache[.]org/security-2026-07[.]html
- **Original Report:** hxxps[://]thehackernews[.]com/2026/08/ai-assisted-http-terminator-finds-novel[.]html