Skip to main content

Apache APISIX CVE-2026-74848

| EUVDEUVD-2026-66958 HIGH
HTTP Request/Response Smuggling (CWE-444)
2026-08-26 GHSA-3g86-xcpq-wppj
Apache Information Disclosure Request Smuggling
7.0
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
7.0 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable gateway needs no auth; AC:H reflects HTTP smuggling timing complexity; scope changed because cross-user response leakage affects other clients' confidentiality.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
CVSS changed
Aug 27, 2026 - 10:22 NVD
7.0 (HIGH)
Analysis Generated
Aug 26, 2026 - 16:22 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News 3 New Apache Vulnerabilities - 3 High Severity Aug 27, 2026

AnalysisAI

Response poisoning in Apache APISIX 2.12.0 through 3.17.0 enables remote attackers to manipulate the gateway's serverless plugin routes so that victims receive attacker-chosen content or other authenticated users' API responses. The root cause is inconsistent HTTP request boundary interpretation - the defining characteristic of HTTP Request/Response Smuggling - applied within APISIX's serverless plugin execution pipeline. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send crafted HTTP requests to serverless-plugin route
Delivery
Exploit inconsistent request boundary parsing in gateway
Exploit
Desynchronize response-to-connection mapping
Execution
Victim request served attacker-chosen or another user's response
Impact
Sensitive API response data disclosed or integrity violated
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the targeted Apache APISIX instance is running a version between 2.12.0 and 3.17.0 inclusive, and that at least one route is configured to use a serverless plugin (serverless-pre-function or serverless-post-function). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment No CVSS vector was supplied with this advisory, limiting quantitative scoring; independent metrics are assessed below. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A remote attacker sends a sequence of specially crafted HTTP requests to an Apache APISIX serverless-plugin route, exploiting ambiguous request boundary parsing to desynchronize the gateway's connection handling. A victim who subsequently sends a legitimate request over the same or a pipelined connection receives the attacker's injected response content - or another authenticated user's API response - potentially exposing session tokens, business data, or PII. …
Remediation The primary and confirmed fix is upgrading Apache APISIX to version 3.18.0, which addresses the inconsistent HTTP request boundary handling in serverless plugin routes; upgrade procedures and release notes are available at https://apisix.apache.org. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-74848 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy