Executive brief
Apache Traffic Server, a high-performance caching proxy used to manage web traffic, is vulnerable to a critical security flaw. An attacker can send specially crafted web requests to bypass security controls, potentially gaining unauthorized access to sensitive data or interfering with other users' sessions. Organizations using affected versions should upgrade immediately to prevent potential data breaches or service manipulation.
Technical details
A request smuggling vulnerability (CWE-444) exists in Apache Traffic Server due to the inconsistent interpretation of malformed HTTP chunked messages. By sending specially crafted chunked requests, a remote, unauthenticated attacker can desynchronize the proxy's interpretation of the request stream from that of the backend server. This allows the attacker to 'smuggle' a hidden request that is prepended to the next legitimate user's request, potentially leading to credential theft, security filter bypass, or cache poisoning. The issue is resolved in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3
Timeline
- 2026-07-29: advisory: Vulnerability disclosed by Apache Software Foundation
- 2026-07-29: patched: Fixes released in versions 9.2.15 and 10.1.4