Skip to main content

Apache Traffic Server EUVDEUVD-2026-50172

| CVE-2026-57834 HIGH
HTTP Request/Response Smuggling (CWE-444)
2026-07-29 apache GHSA-rphg-9r4x-89j3
Apache Request Smuggling Information Disclosure Apache Traffic Server
7.0
CVSS 4.0 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
7.0 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Unauthenticated network attack (AV:N/PR:N) needing a parser-differential and crafted framing raises complexity (AC:H); smuggling crosses a trust boundary (S:C) with limited confidentiality/integrity impact on backends and other clients.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Analysis Updated
Jul 29, 2026 - 08:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 29, 2026 - 08:22 vuln.today
cvss_changed
Severity Changed
Jul 29, 2026 - 08:22 NVD
MEDIUM HIGH
CVSS changed
Jul 29, 2026 - 08:22 NVD
10.0 (MEDIUM) 7.0 (HIGH)
Analysis Generated
Jul 29, 2026 - 08:20 vuln.today
CVE Published
Jul 29, 2026 - 07:25 cve.org
MEDIUM 10.0

DescriptionCVE.org

Apache Traffic Server allows request smuggling if chunked messages are malformed.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to desynchronize the proxy from backend origin servers by sending malformed chunked-transfer-encoded messages, per Apache advisory and NVD. Successful exploitation lets an attacker poison caches, bypass access controls, or disclose another client's information as tagged by the reporting source. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach internet-facing ATS proxy
Delivery
Send request with malformed chunked body
Exploit
Trigger parser desync with origin
Execution
Smuggle request across connection boundary
Impact
Poison cache or hijack victim response
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires sending an HTTP message with a malformed chunked (Transfer-Encoding: chunked) body to Apache Traffic Server, and depends on a parsing differential existing between ATS and the upstream/downstream server it is chained to - reflected by the CVSS AT:P (attack requirements present) metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L, base 7.0) shows an unauthenticated, network-reachable, low-complexity attack whose impact falls entirely on SUBSEQUENT systems (SC:H/SI:H/SA:L) rather than the ATS process itself (all vulnerable-system impacts N) - consistent with smuggling, where the harm lands on backends and other clients. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a single crafted HTTP request over the network to an internet-facing ATS proxy in which the chunked body is deliberately malformed so ATS and the origin server disagree on where the request ends. The smuggled trailing bytes are then interpreted by the backend as the start of the next victim's request, letting the attacker poison the shared cache, route a victim to attacker-controlled content, or capture another user's response. …
Remediation Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 or 10.1.4, which correct the chunked-message parsing per the Apache advisory (https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all Apache Traffic Server deployments and identify those running vulnerable versions 8.0-8.1.9, 9.0-9.2.14, or 10.0-10.1.3; document their network exposure, backend system connectivity, and data sensitivity. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Traffic Server

View all
CVE-2026-58161 CRITICAL
9.2 Jul 29

Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
CVE-2026-58154 CRITICAL
9.2 Jul 29

Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
CVE-2026-58155 CRITICAL
9.2 Jul 29

Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
CVE-2026-58151 HIGH
8.7 Jul 29

Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
CVE-2026-58188 HIGH
8.4 Jul 29

Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
CVE-2026-58162 HIGH
8.4 Jul 29

Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
CVE-2026-58164 HIGH
8.3 Jul 29

Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
CVE-2026-58163 HIGH
8.3 Jul 29

Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
CVE-2026-58184 HIGH
8.3 Jul 29

Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
CVE-2026-58177 HIGH
8.3 Jul 29

Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
CVE-2026-58180 HIGH
8.2 Jul 29

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
CVE-2026-58178 HIGH
8.2 Jul 29

Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2018-3907 CRITICAL POC
10.0
CVE-2023-41265 CRITICAL POC
9.9
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8
CVE-2021-38162 CRITICAL POC
9.4

Same technique Request Smuggling

View all
CVE-2018-3907 CRITICAL POC
10.0
CVE-2023-41265 CRITICAL POC
9.9
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8
CVE-2021-38162 CRITICAL POC
9.4

Share

EUVD-2026-50172 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy