Apache Traffic Server CVE-2026-24033

Q: What is the CVSS score of CVE-2026-24033?

CVE-2026-24033 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50170 MEDIUM

HTTP Request/Response Smuggling (CWE-444)

2026-07-29 apache

GHSA-h8g5-f6vh-4g26

Apache Information Disclosure Request Smuggling Apache Traffic Server Apache Software Foundation

6.9

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-accessible proxy, no auth required, scope changes to backend; limited but real confidentiality and integrity impact via cache poisoning and request capture.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 29, 2026 - 08:22 NVD

7.2 (MEDIUM) 6.9 (MEDIUM)

Analysis Generated

Jul 29, 2026 - 08:18 vuln.today

CVE Published

Jul 29, 2026 - 07:22 cve.org

MEDIUM 7.2

DescriptionCVE.org

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

AnalysisAI

HTTP request smuggling in Apache Traffic Server allows unauthenticated remote attackers to interfere with how the proxy and backend servers interpret HTTP request boundaries, enabling cache poisoning and limited information disclosure. Versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 are confirmed affected per Apache advisory. The Scope Changed (S:C) CVSS metric reflects that exploitation crosses the proxy boundary to impact downstream backend systems. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Apache Traffic Server (ATS) is an open-source, enterprise-grade HTTP/1.1 and HTTP/2 reverse proxy and caching server. The vulnerability stems from CWE-444 (Inconsistent Interpretation of HTTP Requests), a class of flaw where a front-end proxy and back-end server parse ambiguous HTTP headers - typically Content-Length and Transfer-Encoding - differently, causing them to disagree on where one HTTP request ends and the next begins. CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server:*:*:*:*:*:*:*:* covers both the 9.x and 10.x affected branches. The Scope Changed metric in the CVSS vector is consistent with how smuggling attacks escape the proxy tier and affect backend application servers that trust ATS as an intermediary.

RemediationAI

Upgrade to Apache Traffic Server 9.2.15 (for 9.x deployments) or 10.1.4 (for 10.x deployments), as confirmed by the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. If immediate upgrade is not feasible, consider placing a WAF or additional HTTP normalization layer upstream of ATS that rejects or normalizes ambiguous Transfer-Encoding and Content-Length header combinations; this adds latency and may break some clients sending non-standard requests. Restricting direct internet-facing exposure of ATS instances reduces the attacker pool but does not eliminate the risk in multi-tenant or shared hosting environments where internal users could still exploit the flaw. Monitoring ATS access logs for requests with conflicting Transfer-Encoding and Content-Length headers can serve as a detection signal.