AI Tool Finds Novel HTTP Desync Techniques; Apache Traffic Server 0-Day

Fri, 07 Aug 2026 11:54:55 +0000

Engineer — Plan: An Apache Traffic Server zero-day surfaced during this research with no patch yet available; confirm whether ATS is in your proxy stack and monitor PortSwigger and Apache advisories for remediation guidance. The novel desync techniques also warrant a review of request-handling assumptions in any HTTP pipeline you operate.
SOC/IR — Learn: PortSwigger’s research introduces new HTTP desynchronization primitives that expand the attack surface for reverse proxies and CDNs, but no IOCs, active exploitation, or mappable TTPs are published yet — file for context when building HTTP-layer detections.
Leader — Skip

Http-Desync on CuraSec