Apache Traffic Server CVE-2026-57834

Exploitation requires sending an HTTP message with a malformed chunked (Transfer-Encoding: chunked) body to Apache Traffic Server, and depends on a parsing differential existing between ATS and the upstream/downstream server it is chained to - reflected by the CVSS AT:P (attack requirements present) metric. No authentication (PR:N) and no user interaction (UI:N) are needed, and the vector is network-reachable (AV:N), so any ATS instance on an affected version (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) that proxies traffic to an origin is potentially exposed. The limiting factor is that impact falls on the backend and other clients (subsequent-system scope) rather than granting code execution on ATS itself, and success hinges on how the paired origin server parses the same malformed framing.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L, base 7.0) shows an unauthenticated, network-reachable, low-complexity attack whose impact falls entirely on SUBSEQUENT systems (SC:H/SI:H/SA:L) rather than the ATS process itself (all vulnerable-system impacts N) - consistent with smuggling, where the harm lands on backends and other clients. The AT:P (Attack Requirements Present) metric signals exploitation depends on specific conditions, namely a malformed chunked message and a parsing-differential between ATS and its peer, so it is not a trivially universal attack. No EPSS score, POC, or KEV entry is provided, so real-world exploitation cannot be evidenced; treat this as a credible priority for internet-facing ATS deployments given the unauthenticated network vector, but not an under-active-attack emergency. Prioritize based on exposure of the proxy and the sensitivity of what sits behind it.

An attacker sends a single crafted HTTP request over the network to an internet-facing ATS proxy in which the chunked body is deliberately malformed so ATS and the origin server disagree on where the request ends. The smuggled trailing bytes are then interpreted by the backend as the start of the next victim's request, letting the attacker poison the shared cache, route a victim to attacker-controlled content, or capture another user's response. No authentication or user interaction is required, though the attack depends on a parsing-differential between ATS and its peer (CVSS AT:P).