An AI-assisted research system dubbed HTTP Terminator has uncovered novel HTTP desynchronization techniques and a zero-day in Apache Traffic Server, underscoring the growing role of machine learning in offensive security research.[1][2][3] The flaw, now tracked as CVE-2026-63078 and patched by the Apache Traffic Server project, was disclosed this week by PortSwigger researcher James Kettle and has already been folded into recent proxy hardening guidance.[1][2][3]
HTTP Terminator, built by Kettle at PortSwigger, generated and evaluated roughly 30,000 candidate desynchronization vectors and then used them to probe around 30,000 live websites for previously unseen request smuggling behaviors.[1][2] PortSwigger reports that the system’s aggressive search led to multiple new categories of HTTP desynchronization triggers that traditional, manually curated test suites had missed.[2]
According to PortSwigger’s write-up, a human-guided investigation that followed one of HTTP Terminator’s anomalous payloads ultimately exposed a desynchronization zero-day in Apache Traffic Server’s request handling pipeline.[2][3] A more detailed account describes the trigger as a malformed sequence involving a DELETE request, a Content-Location header, a Max-Forwards: 0 directive and a TRACE payload, which together caused Traffic Server to corrupt its internal understanding of where one request ended and the next began.[3] That desynchronization opened the door to classic request smuggling-style abuse, allowing an attacker positioned in front of the proxy to manipulate how downstream services interpreted queued requests on shared connections.[3]
The Apache project has assigned the issue CVE-2026-63078, and PortSwigger states that the bug has been patched in current releases of Apache Traffic Server, though official NVD scoring information for the CVE is not yet broadly visible.[2][3] The zero-day emerges against the backdrop of a broader July 2026 security release for Traffic Server that fixed a slate of HTTP/2 and caching flaws, including HPACK encoder state desynchronization tracked as CVE-2026-65100 and cache and object-handling issues such as CVE-2026-58163.[4][6][13] Those vulnerabilities affect Traffic Server branches 8.0.0 through 8.1.9, 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3, with patches available in versions 9.2.15 and 10.1.4.[4][6][11][12][13] Independent analysis of the July batch notes that several Traffic Server issues carry CVSS v4.0 base scores of 9.2 (Critical), illustrating how proxy-layer flaws can quickly escalate into high-impact outages or data exposure events.[12]
Public exploit code for the newly disclosed Traffic Server desynchronization vulnerability does not yet appear to be widely available, and at least one closely related exposure of cross-client data leakage, CVE-2026-58157, currently has no known proof-of-concept or reports of exploitation in the wild.[11] CISA’s late-July vulnerability summary nevertheless flags multiple Apache Traffic Server issues, signaling that U.S. federal agencies and critical infrastructure operators are expected to prioritize remediation.[5]
PortSwigger’s research further suggests that other reverse proxies and application delivery platforms—including F5 BIG-IP, BeyondTrust Secure Remote Access, Citrix NetScaler, Azure Application Gateway and certain Akamai deployments—also exhibited exploitable HTTP desynchronization behaviors under the AI-generated test corpus.[3] Security guidance around the July Traffic Server release advises organizations to inventory all proxy instances, migrate off unsupported 8.x branches, upgrade 9.x and 10.x deployments to 9.2.15 or 10.1.4 respectively, and restart services to flush any long-lived connections that may still rely on vulnerable code paths.[11][12][13] Beyond patching, defenders should tighten network access controls around their reverse proxies, monitor for unusual request patterns that indicate smuggling or desynchronization attempts, and treat AI-discovered anomalies as early warning signs rather than outliers.
References
- AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques …
- Can AI do novel security research? Meet the HTTP Terminator
- AI-Assisted HTTP Desync Research Uncovers New Request Smuggling …
- CVE-2026-65100 Detail – NVD
- Vulnerability Summary for the Week of July 27, 2026
- Apache Traffic Server mishandles on-disk cache fields and …
- CVE-2026-58157 – Exploits & Severity
- Emerging Threat: (July 2026 Release) Apache Traffic …
- CVE-2026-65100: Apache Traffic Server HTTP/2 DoS Flaw
