AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
- ID
- 11902
- Status
- summarized
- Published
- 07 Aug 2026, 6:09 PM
- Fetched
- 07 Aug 2026, 9:51 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/ai-assisted-http-terminator-finds-novel.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.5
- Created
- 07 Aug 2026, 9:52 PM
- Tags
- Audience
- developersai_ml_learners
What happened
James Kettle at PortSwigger built 'HTTP Terminator,' an AI-assisted research system that ingested 138 HTTP/SMTP RFCs split into ~15,000 fragments to generate 30,000 candidate HTTP desync vectors. Testing against 30,000 authorized websites surfaced ~700 vulnerable targets including banks, government infrastructure, and an airport, plus a patched Apache Traffic Server zero-day (CVE-2026-63078). The research produced a new 'dangling-byte' technique that makes response queue poisoning reliable by leaving a smuggled request one byte short, and a Content-Type: multipart/byteranges vector that exposed 200+ sites including a U.S. bank.
Why it matters
If your stack uses HTTP/1.1 between a front-end proxy and back-end servers, PortSwigger's unchanged recommendation applies now: remove HTTP/1.1 upstream where possible, or at minimum allow-list methods at both layers and restrict which methods may carry request bodies. The AI methodology—feeding RFC fragments to generate candidate attack vectors at scale—also signals that AI-assisted fuzzing of protocol specifications is becoming a practical research tool, not just a novelty.
Discussion angle
The dangling-byte technique is a clever engineering insight: leaving a smuggled request one byte short eliminates the race condition that made RQP unreliable—worth discussing how small protocol-level details become exploitable, and whether AI-assisted RFC mining changes how teams should approach spec-compliance testing.