HTTP Terminator: AI found desync flaws and an Apache Traffic Server zero-day

HTTP Terminator is a system designed by James Kettle to autonomously search for discrepancies in HTTP implementations. Rather than asking a model to “find vulnerabilities”, the researcher supplied a specification corpus, a hypothesis-generation process and a controlled measurement environment. The results included new HTTP desync triggers, techniques that strengthened response queue poisoning, and a human-guided chain that led to a flaw in Apache Traffic Server.

The most useful lesson is not that AI replaced a researcher. The system was productive because an expert encoded the right questions, constrained the experiment and could distinguish an anomaly from a real security boundary.

Desynchronisation is an interpretation conflict

In a reverse-proxy architecture, at least two components read the same stream: a front end accepts the request and a back end processes the forwarded message. If they disagree about its length or header semantics, bytes considered body data by one parser may become the next request for another. On a shared connection, this can associate a response with the wrong user, bypass routing controls or poison the response queue.

HTTP Terminator processed 138 HTTP and SMTP specifications split into roughly 15,000 fragments. Combining their rules produced around 30,000 candidates, whose behaviour was tested across an authorised set of approximately 30,000 websites. An early stage flagged close to 700 systems for further validation; that figure does not mean 700 confirmed critical vulnerabilities.

PortSwigger describes the research in “Can AI Do Novel Security Research? Meet the HTTP Terminator”. The system identified cases involving two matching Content-Length headers and a “dangling byte” technique that helped turn an inconspicuous parsing difference into response queue poisoning.

Why Apache Traffic Server still required a human

An autonomous scanner observes correlations: different response times, an unexpected status, extra bytes or a changed order. It does not automatically understand the target’s complete topology. For Apache Traffic Server, iterative human investigation was needed to connect several apparently separate anomalies into a repeatable chain and report it to the vendor.

Public reporting associates the issue with CVE-2026-63078. Administrators should track the official Apache Traffic Server advisory for their maintained branch, because repeating a CVE identifier from a presentation does not replace mapping the fix to an exact build and distribution package.

The system also proposed a class named Shared-Parser Confusion. A human had to validate the hypothesis, reject false generalisations and determine where a trust boundary was actually crossed. This is a sound model for using AI in security research: the machine increases hypothesis throughput; the expert remains accountable for proof, impact and disclosure.

Defending the HTTP stack

1. Map every protocol translation: CDN to load balancer, load balancer to proxy and proxy to application. Knowing that the client uses HTTP/2 is insufficient.
2. Prefer end-to-end HTTP/2 or HTTP/3 and remove unnecessary upstream HTTP/1.1 where the stack supports it.
3. Make method and message-length validation consistent at every layer. Reject conflicting, repeated or ambiguous headers instead of normalising them.
4. Where HTTP/1.1 must remain, allowlist methods at both the edge and back end, and permit request bodies only for methods that need them.
5. Disable connection sharing across trust contexts where consistent parsing cannot be guaranteed.
6. Test the complete production component chain in an authorised environment. Scanning one server will not reproduce a desync created by a parser pair.
7. Monitor clusters of 400 responses, length mismatches, premature connection closes and responses that do not match a user’s request ID.

Facts and Breachroad analysis

PortSwigger confirms the corpus scale, candidate count and newly identified behaviours. An automated flag is not the same as a validated vulnerability; moving from anomaly to impact remained research work. Treating proxy configuration as one composite parser is Breachroad’s conclusion from desynchronisation mechanics.

Application security training helps developers and operators understand discrepancies between layers. A web application penetration test should exercise the real CDN–proxy–application chain rather than only a server’s direct port.