Apache Traffic Server EUVD-2026-50173

The specific prerequisite is that Apache Traffic Server must accept inbound HTTP/2 client connections and proxy to an HTTP/1.1 backend (the downgrade path), because the smuggling arises when ATS translates an HTTP/2 request carrying a Transfer-Encoding header into HTTP/1.1. The exact trigger stated in the description is an HTTP/2 request containing a Transfer-Encoding header, which ATS fails to reject. Limiting factors: a downstream origin/backend whose HTTP/1.1 parser interprets the smuggled Transfer-Encoding differently than ATS is required for the desync to have effect, and deployments that terminate at ATS without an HTTP/1.1 downgrade, or that disable HTTP/2 on client listeners, are not exposed. Per CVSS (PR:N/UI:N/AC:L), no authentication, no user interaction, and no unusual client-side complexity are needed against a reachable, HTTP/2-enabled ATS proxy.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, base 7.8/High) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction - consistent with an internet-facing proxy. Impact is modest on the vulnerable ATS system itself (VC:N/VI:L/VA:N) but high on subsequent systems (SC:H/SI:H), correctly modeling smuggling risk: the damage lands on the backend and other clients (cache poisoning, request hijacking, credential/session theft, access-control bypass) rather than on ATS. No EPSS score, SSVC decision, KEV entry, or POC was supplied, so real-world exploitation pressure cannot be quantified from the input; the absence of a Transfer-Encoding score in the data means priority rests on the CVSS signal plus the intrinsically weaponizable nature of smuggling. This is a genuine priority for internet-exposed ATS instances fronting sensitive origins, though the requirement for a specific vulnerable-yet-tolerant backend parser tempers universal exploitability.

An attacker sends a crafted HTTP/2 request to an internet-facing ATS reverse proxy that includes a Transfer-Encoding: chunked header; ATS accepts it and downgrades the request to HTTP/1.1 toward the backend, which now interprets the message boundaries differently and treats attacker-controlled trailing bytes as the start of a new, injected request. This lets the attacker poison the shared cache, hijack or redirect another user's in-flight request, or bypass front-end access controls. No public POC was provided, but the AC:L/PR:N/UI:N profile means exploitation requires only the ability to reach the proxy over the network.