Full research report
AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
Executive assessment
PortSwigger's HTTP Terminator represents a meaningful advance in protocol security research methodology: an autonomous system that derived novel HTTP desync techniques from RFC text at a scale no individual researcher could replicate, discovering ~700 vulnerable targets across critical infrastructure sectors during authorised scanning. The technical contributions — dangling-byte RQP stabilisation, Shared-Parser Confusion, dual Content-Length triggers, and multipart/byteranges desync — are credibly disclosed and corroborated by first-party published research. The Apache Traffic Server zero-day (CVE-2026-63078) is genuine in the sense that PortSwigger discloses it with technical specificity, but the CVE record remains absent from three independent public databases as of 8 August 2026, leaving defenders unable to confirm the precise fixed version mapping. The July 2026 ATS releases (9.2.15 / 10.1.4) should be treated as the current safe baseline pending formal CVE publication. The durable risk — any proxy deployment still using HTTP/1.1 upstream — extends well beyond Apache Traffic Server and is not resolved by patching alone.
What happened
PortSwigger researcher James Kettle presented HTTP Terminator at Black Hat USA 2026 and DEF CON 34 on 7 August 2026. The AI-assisted system ingested 138 HTTP and SMTP RFCs, split into roughly 15,000 fragments, and generated 30,000 unique candidate desync vectors tested across 30,000 authorised targets, yielding approximately 700 vulnerable sites including banks, government systems, and airport infrastructure. A separate human-guided investigation exposed a desynchronisation zero-day in Apache Traffic Server, disclosed as CVE-2026-63078 and stated to be patched, though no public CVE record had appeared in NVD, CVE.org, or third-party aggregators as of 8 August 2026.
Affected scope
Apache Traffic Server, with affected versions unconfirmed in public records; the July 2026 releases (9.2.15 and 10.1.4) are the current recommended patch baseline for the broader vulnerability batch. The novel desync techniques extend to any deployment using HTTP/1.1 between a front-end proxy and internal system server, with confirmed authorised-scan exposure in financial, government, security-vendor, and transport sectors.
Technical assessment
HTTP Terminator exploits framing ambiguity in HTTP/1.1 message boundaries between proxy layers. Novel triggers include a dual-matching Content-Length header pattern, Content-Type: multipart/byteranges in requests, and HTTP/1.0 combined with Transfer-Encoding: gzip. The dangling-byte technique improves response queue poisoning (RQP) reliability by leaving a smuggled request one byte short so only an arriving victim request supplies the missing byte, eliminating the race condition that ordinarily limits RQP on many targets. Shared-Parser Confusion arises when a server reuses the same parsing code for both requests and responses. CVE-2026-63078 specifically was triggered via a DELETE method with a Content-Location header and TRACE-based payload against Apache Traffic Server.
Recommended defensive actions
- Upgrade Apache Traffic Server to 9.2.15 or 10.1.4, the current recommended releases addressing the July 2026 vulnerability batch.
- Migrate upstream proxy connections from HTTP/1.1 to HTTP/2 or higher to eliminate the ambiguous framing that enables desync attacks.
- Configure allow-lists on both front-end and internal system layers restricting request bodies to POST, PUT, and PATCH only; deny bodies on GET, HEAD, and OPTIONS.
- Monitor proxy access logs for anomalous session-crossing responses, unexpected HTTP 400/501 errors from back-ends, or mismatched response lengths as indicators of RQP activity.
- Subscribe to Apache Security announcements and the NVD CVE feed to obtain the specific affected-version mapping for CVE-2026-63078 when the record is formally published.
Uncertainties and evidence gaps
- CVE-2026-63078 has no public record in NVD, CVE.org, MITRE, or the stack.watch Apache Traffic Server aggregator as of 8 August 2026; precise affected and fixed versions cannot be independently confirmed.
- It is unknown whether CVE-2026-63078 is included in the July 2026 ATS patch batch (9.2.15 / 10.1.4) or is pending a separate release.
- No independent Apache Security advisory was accessible to verify the fix scope or CVSS scoring for CVE-2026-63078.
- No CVE identifiers have been assigned for Shared-Parser Confusion, the dangling-byte technique, or the other novel desync triggers beyond the Apache zero-day.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation; CVE-2026-63078 was discovered during authorised research scanning and has been reported as patched by the discoverers, with no evidence of in-the-wild use.
The investigation began with a single secondary article describing a Black Hat 2026 presentation and an Apache Traffic Server zero-day. The PortSwigger research page was fetched to obtain first-party technical detail and confirmed the techniques and the CVE-2026-63078 disclosure. Three independent CVE aggregators — NVD search results, stack.watch's 41-CVE ATS listing, and CyCognito's advisory analysis — all confirmed the CVE record is not yet public, consistent with the secondary article's own noted gap. The Apache Traffic Server homepage confirmed the July 2026 patch releases as the current safe baseline. The research itself is well-corroborated; the Apache CVE mapping remains an open verification gap.
- What does the primary source article claim about the event, the techniques, and the Apache zero-day?Fetched The Hacker News articlethehackernews.com ↗
Reports HTTP Terminator tested 30,000 vectors across 30,000 authorised sites and found ~700 vulnerable targets; a human-guided cascade exposed CVE-2026-63078 in Apache Traffic Server; article itself notes the CVE was not in CVE.org or NVD as of publication.
why Established the event and immediately surfaced a verification gap requiring independent investigation.
- Does CVE-2026-63078 appear in authoritative CVE databases?Searched NVD, CVE.org, and MITRE for CVE-2026-63078
No matching record found; closest results were CVE-2025-63078 and CVE-2026-43078, both unrelated identifiers.
why Confirmed the CVE record is not yet public, meaning defenders cannot independently verify affected scope or fixed version.
- What do PortSwigger's own published materials say about the techniques and the Apache fix?Fetched the official PortSwigger HTTP Terminator research pageportswigger.net ↗
Confirmed all claimed techniques — dangling-byte RQP improvement, Shared-Parser Confusion, dual Content-Length pattern, multipart/byteranges trigger, and CONNECT-based vectors. CVE-2026-63078 linked to DELETE + Content-Location + TRACE payload. Patch stated but no specific version given.
why First-party confirmation of the research substance; the absence of a fixed version in the write-up is consistent with the CVE record being pending.
- What are the current Apache Traffic Server releases and does the homepage reference CVE-2026-63078?Fetched the Apache Traffic Server project homepagetrafficserver.apache.org ↗
Latest disclosed releases are 9.2.14 and 10.1.3 (July 16, 2026), addressing 34 vulnerabilities. No mention of CVE-2026-63078.
why Established the current patch baseline but could not confirm whether the zero-day is included; subsequent sources indicated a later July 29 release (9.2.15 / 10.1.4).
- Does the July 2026 ATS patch batch independently list CVE-2026-63078 as one of the fixed issues?Fetched CyCognito's analysis of the July 2026 Apache Traffic Server releasecycognito.com ↗
July 29 release (9.2.15 / 10.1.4) addresses CVEs in the CVE-2026-58xxx range plus several others. CVE-2026-63078 is absent. Several HTTP request-smuggling CVEs are present under different identifiers.
why Independent corroboration that CVE-2026-63078 is not in the publicly documented batch, either embargoed or on a separate patch schedule.
- Does a comprehensive CVE aggregator for Apache Traffic Server include CVE-2026-63078?Fetched stack.watch listing of all 2026 Apache Traffic Server CVEsstack.watch ↗
41 CVEs listed for 2026; most recent entries dated 29 July 2026. CVE-2026-63078 is not among them.
why A third independent data source confirming the record is not yet publicly indexed, solidifying the verification gap assessment.
Research coverage
All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| The Hacker Newsnews | ok12 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1662 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | ok5322 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok676 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1008 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok7541 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 9 opened outside the registered collection
Technical references3
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Repository captured from the source article as technical context; not validated as PoC or exploit code.
PoC & exploit code1
Primary research page describing the tool and linking to the open-source release; the scanner itself is the closest public technical artefact.
Vendor & gov advisories1
Authoritative first-party disclosure covering all techniques and CVE-2026-63078; no formal Apache advisory independently verified.
Analysis & research3
Secondary reporting that itself flags CVE-2026-63078 as absent from NVD and CVE.org as of 7 August 2026.
Independent analysis of the July 2026 ATS patch batch; CVE-2026-63078 is absent, confirming the record is not yet publicly indexed.
Aggregates 41 ATS CVEs published in 2026; CVE-2026-63078 is not among them as of 8 August 2026.