Defenders should treat HTTP/1.1 upstream connections as the weak link once again. PortSwigger has open-sourced HTTP Terminator, an AI-assisted research system that produced new HTTP desynchronization techniques and contributed to the discovery of a now-patched Apache Traffic Server zero-day.
The Apache flaw, tracked as CVE-2026-63078, emerged from a human-guided test cascade rather than the automated pipeline. Researchers caution that no public record for the identifier existed when checked, so defenders cannot yet map it to a fixed Traffic Server release.
HTTP Terminator, built by PortSwigger’s James Kettle, generated 30,000 candidate desync vectors from fragments of 138 HTTP and SMTP RFCs. Against 30,000 authorized bug bounty and disclosure targets, it found roughly 700 vulnerable sites, spanning banks, government infrastructure, security products, and an airport.
One construction worth singling out is a Content-Type multipart/byteranges arrangement that held up across multiple server implementations and flagged more than 200 targets, among them an unnamed US bank.
New findings include a dual-matching Content-Length pattern and a dangling-byte method that improves response queue poisoning reliability. The response-queue-poisoning class of attack can leave a front end misassigning back-end responses, spilling session cookies or API keys to the wrong user. The dangling-byte variant keeps a smuggled request one byte short, so the second response only appears once a victim request fills the gap — removing the race condition that previously made the technique unreliable.
The system also proposed Shared-Parser Confusion, where response-processing rules get misapplied to requests when servers reuse parsing logic; Kettle validated the concept manually.
PortSwigger’s standing advice holds: avoid HTTP/1.1 upstreams where possible, and allow-list request methods at both proxy layers.
