Apache Traffic Server CVE-2026-58153

Exploitation requires Apache Traffic Server to be deployed as a reverse proxy where the origin-facing connection uses HTTP/2 and the client-facing connection uses HTTP/1.1 - the specific mixed-protocol topology that triggers the vulnerable conversion path. Additionally, the origin server must send HTTP/2 trailer fields in its responses; origins that never emit trailers are not exploitable regardless of protocol configuration. The CVSS vector (PR:N/UI:N) confirms no authentication or user interaction is required from the attacker's perspective at the ATS layer. Exploitation is limited to ATS versions 10.0.0-10.1.3 (and pre-9.2.15 in the 9.x branch); pure HTTP/1 proxy deployments and end-to-end HTTP/2 deployments are not affected.

The CVSS 8.3 score is driven by the S:C (Scope Changed) designation, which is well-justified - downstream HTTP/1 clients are distinct from ATS itself and bear the impact of response injection. The AV:N/AC:L/PR:N/UI:N vector means the attack path is network-accessible, low complexity, unauthenticated, and requires no user interaction, making it easily automatable if a reliable exploit emerges. However, exploitation is constrained by a specific deployment topology requirement (HTTP/2 origin, HTTP/1 downstream, trailer usage), which is not universal even among ATS deployments. Without EPSS data, exploitation probability cannot be quantified numerically; the absence of both KEV listing and public POC code suggests active exploitation is not yet observed. The individual C/I/A impacts are all Low, so while the combined scope-changed score is high, per-impact consequences are moderate. This is a real priority for ATS operators in mixed-protocol reverse proxy configurations, but lower urgency for those not operating that topology.

An attacker who controls or can influence an HTTP/2 origin server response sends a reply containing HTTP/2 trailers with crafted content. ATS forwards those trailers to a downstream HTTP/1 client without proper chunked framing, causing the client to misinterpret the response boundary and treat the trailer data as the beginning of a subsequent HTTP response. This allows the attacker to inject a forged response, potentially poisoning shared caches or hijacking the next request made by the HTTP/1 client over a keep-alive connection.