PortSwigger's James Kettle has built an AI-assisted research system called HTTP Terminator that generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate attack vectors. The system tested 30,000 websites where scanning was authorized through bug bounty or vulnerability disclosure programs and found roughly 700 vulnerable targets.
The research produced new desync triggers, a dual-matching Content-Length pattern, and a "dangling-byte" technique designed to make response queue poisoning more reliable. Kettle said the findings involved banks, government infrastructure, security products, and an airport.
A separate human-guided discovery cascade also exposed a zero-day in Apache Traffic Server. Let me walk through the HTTP Terminator desync research, what it discovered, and what it means for web security.
How HTTP Terminator Works
The HTTP Terminator desync research began with Kettle feeding the system 138 HTTP and SMTP RFCs. Those RFCs were split into about 15,000 small fragments and used as inspiration to generate 30,000 unique candidate vectors. The system then tested those vectors against real-world websites.
One Content-Type: multipart/byteranges technique worked across multiple server implementations and exposed more than 200 websites in the test set, including an unnamed U.S. bank. This demonstrates the power of AI-assisted research: a single technique found hundreds of vulnerable targets.
The system used Claude for document extraction and test-case generation, while the investigator stage required Claude Code. Kettle separately tested newer models on a rediscovery benchmark and reported a 30% success rate for GPT-5.6 Sol when given an inspiration technique.
The Dangling-Byte Technique
The HTTP Terminator desync research identified one technique that stood out for making response queue poisoning more reliable. The dangling-byte technique leaves a smuggled request one byte short so the second back-end response is not produced until a victim request supplies the missing byte.
This eliminates a race condition that otherwise makes RQP unreliable on many sites. RQP can potentially make a front end lose track of which back-end response belongs to which user, potentially exposing another user's response, including session cookies or API keys.
The dangling-byte technique represents a significant advancement in HTTP desynchronization research. It makes a previously unreliable attack class more predictable and therefore more dangerous.
The Human-Guided Discovery: Apache Traffic Server Zero-Day
The HTTP Terminator desync research also had a human-guided component. A malformed request eventually exposed a desynchronization zero-day in Apache Traffic Server. The researchers said the issue has since been patched and tracked as CVE-2026-63078.
An August 7 check by The Hacker News did not find a public record for CVE-2026-63078 in CVE.org or NVD. Apache's July advisory covering 34 flaws did not list it. This leaves a verification gap around the Apache case. The cited public records do not yet let defenders map CVE-2026-63078 to a specific fixed Traffic Server release.
This gap is concerning. Without a clear mapping, defenders cannot easily determine if their Apache Traffic Server deployments are vulnerable or patched.
Shared-Parser Confusion
The HTTP Terminator desync research also discovered a broader attack concept called Shared-Parser Confusion. The system proposed the concept when it noticed that response-processing rules could be misapplied to requests when servers reuse parsing logic.
Kettle validated and generalized the concept. "Neither of us would have discovered it alone," he said. This distinction defines the autonomy boundary in the HTTP Terminator desync research. The system generated and proved several techniques autonomously, while the Apache zero-day and Shared-Parser Confusion still required Kettle's intervention.
The Scale of Vulnerable Targets
The HTTP Terminator desync research tested 30,000 websites where scanning was authorized. The system found roughly 700 vulnerable targets before deeper validation and RQP research.
Kettle said those findings involved banks, government infrastructure, security products, and an airport. This is a significant finding. HTTP desynchronization vulnerabilities are not limited to obscure or poorly maintained websites. They affect major institutions and critical infrastructure.
The fact that HTTP Terminator found 700 vulnerable targets out of 30,000 sites suggests that HTTP desynchronization vulnerabilities remain a widespread problem.
The Defense Guidance
The defense against the HTTP Terminator desync research findings has not changed. PortSwigger recommends avoiding HTTP/1.1 upstream. Where HTTP/1.1 cannot be removed, the company recommends allow-listing methods at both layers and restricting which methods may carry request bodies.
This is consistent with previous guidance on HTTP desynchronization attacks. The recommended defenses are well-understood, even if they are not always implemented.
The Open-Source Release
PortSwigger has open-sourced HTTP Terminator. This means other researchers can use the system to find similar vulnerabilities. The release of the tool is likely to accelerate research into HTTP desynchronization attacks.
The paper does not identify which exact model or version generated each autonomous discovery. However, the released implementation uses Claude for document extraction and test-case generation.
The Broader Context: CRLF-Powered Desync Attacks
The HTTP Terminator desync research is part of a broader wave of research into HTTP desynchronization attacks. Researchers behind CRLF-powered desync attacks also released public tools for studying this attack class, including crlf-desyncs and crlf-powered-desync-scanner.
This clearly shows that the research field is actively looking into HTTP desynchronization attacks from various perspectives. The combination of AI-based research and manual research will definitely discover more flaws.
What This Means for Defenders
The HTTP Terminator desync research has several implications for defenders.
- First, HTTP desynchronization vulnerabilities are widespread. The number of vulnerable targets found was 700 from 30,000 sites tested. It is important for companies to evaluate themselves.
- Secondly, the use of the dangling-byte technique improves the reliability of response queue poisoning. This increases the risk of successful exploitation.
- Third, the Apache Traffic Server zero-day remains poorly documented. CVE-2026-63078 does not yet have a clear mapping to a fixed release. Organizations using Apache Traffic Server should check with the vendor directly.
- Fourth, the Shared-Parser Confusion concept suggests that parsers may have fundamental issues. Organizations should review their HTTP parsing infrastructure.
- Finally, the open-sourcing of HTTP Terminator means attackers will also have access to the tool. Defenders should assume that attacks based on this research are imminent.
Wrapping It Up
The HTTP Terminator desync research is a major step forward in HTTP desynchronization research. An AI-assisted system generated and proved new attack techniques after exploring 30,000 candidate vectors.
The research produced new desync triggers, a dual-matching Content-Length pattern, and a dangling-byte technique for reliable response queue poisoning. The system found 700 vulnerable targets including banks, government infrastructure, and airports.
A human-guided component discovered an Apache Traffic Server zero-day, though the CVE mapping remains unclear. The Shared-Parser Confusion concept emerged from the system's analysis and was validated by Kettle.
PortSwigger has open-sourced HTTP Terminator. Defenders should conduct an exposure assessment, deploy the suggested defenses, and look out for any attempt to exploit based on this research.
FAQ Section
What is the HTTP Terminator desync research?
It is an AI-assisted research project that generated and proved 30,000 HTTP desynchronization attack vectors. The system found 700 vulnerable targets including banks, government infrastructure, and airports.
What is the dangling-byte technique?
It is a technique that leaves a smuggled request one byte short so the second back-end response is not produced until a victim request supplies the missing byte. This eliminates a race condition and makes response queue poisoning more reliable.
What is Shared-Parser Confusion?
It is an attack concept where response-processing rules can be misapplied to requests when servers reuse parsing logic. The system proposed the concept, and Kettle validated and generalized it.
What Apache Traffic Server vulnerability was found?
The research exposed a desynchronization zero-day tracked as CVE-2026-63078. However, the CVE is not yet mapped to a specific fixed release in public records.
How can I defend against these attacks?
Avoid HTTP/1.1 upstream where possible. If HTTP/1.1 cannot be removed, allow-list methods at both layers and restrict which methods may carry request bodies.
