Executive brief
Apache APISIX is an API gateway that manages and routes incoming web requests. An HTTP request smuggling vulnerability in the serverless plugin component allows attackers to cause other users to receive incorrect or malicious responses, potentially leading to data leakage or session hijacking. This could affect any organization running APISIX as their API management layer.
Technical details
This is an HTTP request/response smuggling vulnerability (CWE-444) affecting the serverless-plugin route processing in Apache APISIX versions 2.12.0 through 3.17.0. The root cause is inconsistent interpretation of HTTP requests, allowing an attacker to inject malicious request data that causes subsequent clients to receive attacker-controlled or unrelated users' responses. The vulnerability is network-accessible on affected APISIX instances. Version 3.18.0 contains a fix; affected users should upgrade immediately.
Affected products
- Apache APISIX 2.12.0 through 3.17.0
Timeline
- 2026-08-26: disclosed: Advisory published by Apache APISIX security team
- 2026-08-27: patched: Fix available in version 3.18.0