AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

Summary: PortSwigger's James Kettle built HTTP Terminator, an AI-assisted research system that fed 138 HTTP and SMTP RFCs split into about 15,000 fragments to generate 30,000 candidate desync vectors, then tested 30,000 authorized websites and found roughly 700 vulnerable targets including banks, government infrastructure, security products, and an airport. A separate human-guided cascade exposed a desync zero-day in Apache Traffic Server, tracked as CVE-2026-63078 and reported patched, though an August 7 check found no public record of it in CVE.org or NVD and Apache's July advisory covering 34 flaws did not list it.
Why it matters: Roughly 700 of 30,000 authorized targets were vulnerable, and response queue poisoning can hand one user another user's session cookies or API keys - the defense PortSwigger names is removing HTTP/1.1 upstream, which many estates cannot do quickly. The Apache case leaves a verification gap: defenders cannot yet map CVE-2026-63078 to a specific fixed Traffic Server release.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-63078
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026