threat-intel
AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
High
Summary
An AI-powered research tool, HTTP Terminator, developed by PortSwigger, autonomously discovered several novel HTTP desynchronization techniques, including a zero-day vulnerability in Apache Traffic Server. The tool, using Claude and GPT-5.6 Sol, identified over 700 vulnerable websites, including a U.S. bank, by exploiting weaknesses in HTTP/1.1 and response queue poisoning (RQP). The vulnerability has been patched, but a gap remains in publicly available information regarding the specific fixed Traffic Server release.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data