Apache Traffic Server CVE-2026-58155

Exploitation requires the ability to send HTTP requests through an Apache Traffic Server proxy running an affected version (8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3), and the crafted request must include a header name long enough to trigger ATS's truncation-instead-of-rejection behavior so that it aliases another header. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is needed and it works against default parsing behavior. The primary limiting factor is architectural: the impact of smuggling/policy bypass depends on ATS fronting a backend or enforcing policies that the aliased header can subvert (routing, auth-forwarding, or filtering headers); a standalone cache with no trusted header logic yields lower practical impact.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N, score 9.3) indicates a remotely reachable, low-complexity, unauthenticated attack with a scope change - consistent with smuggling that crosses the trust boundary from proxy to backend, hence the high integrity impact and the scope flag. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input; the score is driven by intrinsic exploitability, not observed activity. This is a genuine priority for any ATS operator fronting sensitive origins because request smuggling reliably enables policy bypass, but absent EPSS/KEV signals the real-world exploitation likelihood is unconfirmed. No conflict exists between the vector and the description - both point to remote, unauthenticated network exploitation.

An attacker sends a crafted HTTP request containing a header whose name exceeds ATS's length limit so that, after truncation, it aliases a security-relevant header the proxy trusts. The desynchronized interpretation between ATS and the backend lets the attacker smuggle a second request or override a policy header, bypassing access controls or cache/routing rules. No public exploit code was provided, but the low attack complexity (AC:L) and lack of required privileges (PR:N) make crafting such a request straightforward for a skilled attacker.