HTTP Terminator discovery of new HTTP desynchronization techniques and response queue poisoning
Technical Analysis
Summary
Hide ▲
Show ▼
HTTP Terminator generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate attack vectors, expanding the attack surface for parser-confusion flaws. The research also validated response queue poisoning (RQP) and introduced a dangling-byte method that makes it more reliable. A separate path exposed a patched Apache Traffic Server zero-day tracked as CVE-2026-63078, showing direct product impact. The work further identified Shared-Parser Confusion, where response-processing logic can be misapplied to requests.
Related Happenings
Apache Traffic Server desynchronization zero-day (CVE-2026-63078)
Vulnerability
H score35
First: 07.08.2026 13:09
Last: 07.08.2026 13:09
Sources 1
How related:
In the human-guided cascade, a malformed request eventually exposed the desynchronization zero-day in Apache Traffic Server. The researchers said the issue has since been patched and tracked as CVE-2026-63078.
About this happening:
A desynchronization zero-day in Apache Traffic Server was exposed and later patched, leaving a concrete server request-handling flaw tied to CVE-2026-63078. The we...
Apache Traffic Server desynchronization zero-day (CVE-2026-63078)
VulnerabilityHow related: In the human-guided cascade, a malformed request eventually exposed the desynchronization zero-day in Apache Traffic Server. The researchers said the issue has since been patched and tracked as CVE-2026-63078.
About this happening: A desynchronization zero-day in Apache Traffic Server was exposed and later patched, leaving a concrete server request-handling flaw tied to CVE-2026-63078. The we...
Timeline
-
07.08.2026 13:09 2 articles · 7h ago
HTTP Terminator reveals new HTTP desynchronization techniques and a patched Apache Traffic Server zero-day
Technical Analysis UpdatePortSwigger's HTTP Terminator, built by James Kettle, generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate attack vectors and testing 30,000 authorized websites, where it found roughly 700 vulnerable targets before deeper validation and RQP research. The work produced new desync triggers, a dual-matching Content-Length pattern, a dangling-byte technique that makes response queue poisoning more reliable, and Shared-Parser Confusion, while a separate human-guided cascade exposed a desynchronization zero-day in Apache Traffic Server tracked as CVE-2026-63078. Kettle said the findings involved banks, government infrastructure, security products, and an airport, and PortSwigger recommended avoiding HTTP/1.1 upstream or, where that is not possible, allow-listing methods at both layers and restricting which methods may carry request bodies.
Show sources
- AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day — thehackernews.com — 07.08.2026 13:09
- AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day — thehackernews.com — 07.08.2026 13:09