Executive brief
Apache Traffic Server, a high-performance caching proxy used to manage web traffic, contains a vulnerability in how it handles certain web requests. An attacker can exploit this to bypass security controls or intercept sensitive data by confusing the communication between the proxy and the backend servers. Organizations should update to the latest versions to prevent potential unauthorized access or data manipulation.
Technical details
Apache Traffic Server (ATS) is vulnerable to HTTP request smuggling due to the improper handling of the 'Transfer-Encoding' header in HTTP/2 requests. While HTTP/2 uses a built-in framing mechanism for body length, ATS fails to reject requests containing the legacy Transfer-Encoding header. When these requests are downgraded to HTTP/1.1 for backend communication, an attacker can manipulate the request boundaries to 'smuggle' a second, hidden request. This can lead to cache poisoning, security filter bypass, or unauthorized access to backend resources. The issue is fixed in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 8.0.0 - 8.1.9, 9.0.0 - 9.2.14, 10.0.0 - 10.1.3
Timeline
- 2026-07-29: advisory: Initial advisory published by Apache and NVD.