Which versions of Apache Traffic Server are affected by CVE-2026-57834?

Apache Traffic Server versions 8.0 through 10.1 are vulnerable to request smuggling attacks that allow unauthenticated remote attackers to poison proxy caches, bypass access controls, and access…

How to fix or mitigate CVE-2026-57834?

Within 24 hours: Inventory all Apache Traffic Server deployments and identify those running vulnerable versions 8.0-8.1.9, 9.0-9.2.14, or 10.0-10.1.3; document their network exposure, backend system connectivity, and data sensitivity. Within 7 days: Implement network segmentation to restrict direct external access to vulnerable ATS instances; deploy request filtering to reject malformed chunked-transfer-encoded HTTP messages; review proxy access logs for suspicious request patterns indicating cache poisoning attempts. Within 30 days: Monitor Apache Software Foundation security advisories for patched version releases and establish upgrade timelines; evaluate alternative reverse proxy solutions if vendor patch timeline exceeds organizational risk tolerance; conduct cache integrity audits and proactively purge sensitive cached data.

Apache Traffic Server CVE-2026-57834

Q: What is the CVSS score of CVE-2026-57834?

CVE-2026-57834 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50172 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-07-29 apache

GHSA-rphg-9r4x-89j3

Apache Information Disclosure Request Smuggling Apache Traffic Server Apache Software Foundation

7.0

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Unauthenticated network attack (AV:N/PR:N) needing a parser-differential and crafted framing raises complexity (AC:H); smuggling crosses a trust boundary (S:C) with limited confidentiality/integrity impact on backends and other clients.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 08:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 08:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 08:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 08:22 NVD

10.0 (MEDIUM) 7.0 (HIGH)

Analysis Generated

Jul 29, 2026 - 08:20 vuln.today

CVE Published

Jul 29, 2026 - 07:25 cve.org

MEDIUM 10.0

DescriptionCVE.org

Apache Traffic Server allows request smuggling if chunked messages are malformed.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to desynchronize the proxy from backend origin servers by sending malformed chunked-transfer-encoded messages, per Apache advisory and NVD. Successful exploitation lets an attacker poison caches, bypass access controls, or disclose another client's information as tagged by the reporting source. No public exploit identified at time of analysis and the flaw is not in CISA KEV.

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance, open-source forward and reverse HTTP caching proxy used at CDN scale. This flaw is a CWE-444 HTTP Request/Response Smuggling issue: when ATS and a downstream/upstream server parse malformed chunked message bodies inconsistently, the boundary between where one request ends and the next begins is interpreted differently by the two hops. The CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server confirms the affected component is the ATS proxy application itself, and the root cause is lenient or divergent handling of the Transfer-Encoding: chunked framing rather than any memory-safety defect.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 or 10.1.4, which correct the chunked-message parsing per the Apache advisory (https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d). Deployments still on the 8.x line (8.0.0-8.1.9) have no dedicated fixed 8.x release and should migrate to a supported 9.2.15+ or 10.1.4+ build. Where immediate patching is not possible, place a strict HTTP parser in front of ATS (or tighten an existing WAF/frontend) to reject requests with ambiguous or malformed Transfer-Encoding/chunked framing and to normalize conflicting Content-Length and Transfer-Encoding headers; the trade-off is potential rejection of unusual-but-legitimate clients and added latency, and such filtering is a stopgap rather than a substitute for the fixed version.