Is CVE-2026-57834 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57834 being exploited in the wild.

How severe is CVE-2026-57834?

Critical severity, with a CVSS score of 10, published 29 July 2026.

Which products and versions are affected?

Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3.

Is there a fix for CVE-2026-57834?

A patch was published on 2026-07-29: Fixes released in versions 9.2.15 and 10.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57834 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-57834?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57834: Apache Traffic Server request smuggling via malformed chunked messages

CVE-2026-57834 · Severity: critical · CVSS 10 · Published 2026-07-29

Apache Traffic Server, a high-performance caching proxy used to manage web traffic, is vulnerable to a critical security flaw. An attacker can send specially crafted web requests to bypass security controls, potentially gaining unauthorized access to sensitive data or interfering with other users' sessions. Organizations using affected versions should upgrade immediately to prevent potential data breaches or service manipulation.

Quick answers

Is CVE-2026-57834 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57834 being exploited in the wild.
How severe is CVE-2026-57834?: Critical severity, with a CVSS score of 10, published 29 July 2026.
Which products and versions are affected?: Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3.
Is there a fix for CVE-2026-57834?: A patch was published on 2026-07-29: Fixes released in versions 9.2.15 and 10.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57834 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-57834?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A request smuggling vulnerability (CWE-444) exists in Apache Traffic Server due to the inconsistent interpretation of malformed HTTP chunked messages. By sending specially crafted chunked requests, a remote, unauthenticated attacker can desynchronize the proxy's interpretation of the request stream from that of the backend server. This allows the attacker to 'smuggle' a hidden request that is prepended to the next legitimate user's request, potentially leading to credential theft, security filter bypass, or cache poisoning. The issue is resolved in versions 9.2.15 and 10.1.4.

Affected products

Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3

Timeline

2026-07-29: advisory: Vulnerability disclosed by Apache Software Foundation
2026-07-29: patched: Fixes released in versions 9.2.15 and 10.1.4

References

https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.