AI Fuzzing Finds Hundreds of HTTP Desync Exposures
The real break is scale. AI-assisted fuzzing can now surface request-desync bugs across whole classes of HTTP stacks, so a single patched product is not the full boundary; any front end and back end that disagree about request parsing can leak one user’s response into another session.
PortSwigger’s HTTP Terminator generated 30,000 candidate desync vectors and validated about 700 vulnerable targets in authorized testing, including banks, government infrastructure, security products, and an airport. The same research helped uncover a patched Apache Traffic Server zero-day, tracked as CVE-2026-63078, and the technique can expose session cookies or API keys through response queue poisoning.
For operators of Apache Traffic Server, reverse proxies, load balancers, and API gateways that forward HTTP/1.1, the risk is broader than one CVE. If shared intermediaries still let upstream and downstream parsers disagree, the cross-user data leak persists even after the obvious server patch is in place.