Apache Traffic Server CVE-2026-24033

No authentication is required and no special server-side configuration is needed beyond a standard ATS reverse proxy deployment - the CVSS vector PR:N/AC:L/UI:N confirms unauthenticated, low-complexity, no-interaction exploitation against default configurations of Apache Traffic Server acting as an HTTP proxy or cache. Exploitation is limited to HTTP/1.1 request handling contexts where ambiguous header interpretation is possible; HTTP/2 connections, which mandate explicit framing, are not susceptible to classic Content-Length/Transfer-Encoding smuggling. The attacker must be able to send HTTP requests through the ATS instance; if ATS is deployed as a pure internal caching layer not reachable from untrusted networks, the attack surface is reduced to internal actors only.

The CVSS 7.2 score with S:C, PR:N, and AC:L indicates meaningful real-world risk: no authentication or special privileges are required, and exploitation crosses the proxy boundary to reach backend systems. The confidentiality and integrity impacts are rated Low individually (C:L/I:L), but combined with scope change, practical outcomes include cache poisoning (serving attacker-controlled content to other users), cross-user request capture, and bypassing access controls enforced at the proxy layer. EPSS data was not provided; without KEV listing or public exploit confirmation, this is not confirmed to be actively exploited. However, HTTP smuggling is a well-understood technique with established tooling in the security research community, reducing the effective exploitation complexity. The AC:L rating further supports that this is not a hard-to-trigger condition. Priority for organizations running ATS as a reverse proxy or CDN layer should be elevated given the potential for multi-tenant impact.

An external attacker sends a crafted HTTP/1.1 request to ATS containing ambiguous or conflicting Content-Length and Transfer-Encoding headers. ATS interprets the request boundaries differently than the backend application server, causing the tail of the attacker's request to be prepended to a subsequent victim user's request as parsed by the backend. This can result in the attacker capturing sensitive request headers or cookies from another user's session, or poisoning the ATS cache to serve malicious content. No public exploit code has been identified at time of analysis, but the technique is well-documented in public research.