Which versions of Apache Traffic Server are affected by CVE-2026-58150?

Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) contains a critical flaw in HTTP/2 protocol handling that enables attackers to bypass request parsing logic and access…

How to fix or mitigate CVE-2026-58150?

Within 24 hours, identify all systems running Apache Traffic Server versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3 and assess their exposure level. Within 7 days, implement compensating controls: disable HTTP/2 support where operationally feasible, implement strict HTTP request validation and header normalization rules, deploy Web Application Firewall (WAF) signatures to detect smuggling patterns, and increase logging and monitoring of HTTP request anomalies. Within 30 days, evaluate upgrade paths to versions outside the affected ranges and plan a phased deployment timeline, while monitoring vendor advisories for patch availability.

Apache Traffic Server CVE-2026-58150

Q: What is the CVSS score of CVE-2026-58150?

CVE-2026-58150 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-50173 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-07-29 apache

GHSA-5cvm-p8jm-mcrf

Apache Information Disclosure Request Smuggling Apache Traffic Server Apache Software Foundation

7.8

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Network-reachable, unauthenticated, low-complexity smuggling with scope change to the backend; integrity high (injected requests) and confidentiality low (leaked/hijacked responses), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 08:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Jul 29, 2026 - 08:22 NVD

10.0 (HIGH) 7.8 (HIGH)

Analysis Generated

Jul 29, 2026 - 08:16 vuln.today

CVE Published

Jul 29, 2026 - 07:30 cve.org

HIGH 10.0

DescriptionCVE.org

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

HTTP request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) lets remote attackers desynchronize proxy/backend request parsing because the server fails to reject the Transfer-Encoding header on inbound HTTP/2 requests. When ATS downgrades those HTTP/2 requests to HTTP/1.1 for origin servers, the improper Transfer-Encoding directive creates a parsing discrepancy that enables downgrade request smuggling. No public exploit identified at time of analysis and it is not listed in CISA KEV, but this is a well-understood smuggling primitive tagged by the reporter for information disclosure.

Technical ContextAI

Apache Traffic Server is a high-performance forward and reverse HTTP caching proxy widely used in CDN and edge-infrastructure deployments (CPE: cpe:2.3:a:apache_software_foundation:apache_traffic_server). The flaw is a CWE-444 Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). The HTTP/2 specification (RFC 7540/9113) forbids the connection-specific Transfer-Encoding header in HTTP/2 message framing, where message length is instead conveyed by frame structure. ATS accepted the forbidden Transfer-Encoding header rather than rejecting the request, and when it translated (downgraded) the HTTP/2 request into an HTTP/1.1 request toward a backend origin, the smuggled Transfer-Encoding: chunked directive was carried through. The backend then delimits the request body differently than ATS did, splitting one client stream into two divergently-interpreted requests - the root cause class of downgrade smuggling.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line) per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Users on the 8.0.0-8.1.9 line have no listed fixed version and should migrate to 9.2.15 or 10.1.4, as 8.x is unsupported. If immediate patching is not possible, a compensating control is to disable HTTP/2 for client-facing listeners so that Transfer-Encoding cannot enter via HTTP/2 framing - this eliminates the downgrade path at the cost of reduced client performance and multiplexing. Where the origin is under your control, hardening or normalizing the backend to strictly reject Transfer-Encoding/Content-Length conflicts reduces exploitability, though it does not remediate ATS itself and may break legitimate chunked handling if misconfigured.