AI-Assisted HTTP Desync Research Uncovers New Request Smuggling Techniques

PortSwigger Research disclosed an AI-assisted system called HTTP Terminator that autonomously generated, tested, and weaponized novel HTTP desynchronization and request smuggling techniques against authorized live targets. The pipeline, published on GitHub as a multi-stage research framework, reportedly produced tens of thousands of candidate vectors from RFC-derived fragments and led to multiple real-world findings, including new desync triggers, a dual-matching Content-Length desync pattern, a dangling-byte weaponization method to improve response queue poisoning, and evidence of a possible new class dubbed response forking. The work also uncovered and helped patch Apache Traffic Server zero-day CVE-2026-63078, while exposing exploitable issues involving F5 Big-IP, BeyondTrust Secure Remote Access, Citrix NetScaler, and some Azure Application Gateway plus Akamai deployments.

A related PortSwigger paper detailed CRLF-powered desync attacks that turn HTTP header injection in misconfigured Nginx, OpenResty, and Tengine environments into request smuggling, response queue poisoning, browser-powered desync, and even self-propagating desync worms. The researchers said these browser-compatible attacks can enable XSS, account takeover, token and cookie theft, and cross-user compromise across sectors including CDN, telecom, payments, retail, streaming, and social platforms. Recommended mitigations included avoiding unsafe use of $uri or $document_uri in proxy_pass or return directives, reviewing upstream proxy configurations, and enabling HTTP/2 upstream where possible.