Apache Traffic Server EUVD-2026-50205

Q: What is the CVSS score of EUVD-2026-50205?

EUVD-2026-50205 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-58153 MEDIUM

HTTP Request/Response Smuggling (CWE-444)

2026-07-29 apache

GHSA-crqg-wq4g-597m

Apache Information Disclosure Request Smuggling Apache Traffic Server Apache Software Foundation

6.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-accessible proxy requires no auth; scope changes because HTTP/1 downstream clients - not ATS - bear the response injection impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 29, 2026 - 09:22 NVD

8.3 (MEDIUM) 6.3 (MEDIUM)

Analysis Generated

Jul 29, 2026 - 08:53 vuln.today

CVE Published

Jul 29, 2026 - 08:17 cve.org

MEDIUM 8.3

DescriptionCVE.org

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

HTTP/2-to-HTTP/1 protocol conversion in Apache Traffic Server 10.0.0-10.1.3 forwards origin HTTP/2 trailers to downstream HTTP/1 clients without the required chunked transfer encoding framing, enabling HTTP response smuggling. The CVSS 8.3 Scope:Changed rating reflects that exploitation impacts downstream HTTP/1 clients architecturally separate from ATS itself, with potential for cache poisoning, response injection, and limited information disclosure. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.

Technical ContextAI

CWE-444 (Inconsistent Interpretation of HTTP Requests) describes the class of vulnerability where two protocol participants parse message boundaries differently. HTTP/2 natively supports trailing headers sent after the response body, but HTTP/1.1 trailers are only valid within chunked transfer-encoded responses and require specific framing (a zero-length chunk followed by trailer fields). When Apache Traffic Server acts as a reverse proxy translating HTTP/2 origin responses into HTTP/1.1 for downstream clients, it fails to wrap forwarded HTTP/2 trailers in proper chunked framing. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_traffic_server covering versions 10.0.0 through 10.1.3. The ambiguous message framing causes HTTP/1 clients to misparse response boundaries, which is the foundational exploit primitive for request/response smuggling attacks.

RemediationAI

Upgrade Apache Traffic Server to version 10.1.4 (for 10.x branch) or 9.2.15 (for 9.x branch), as confirmed by the Apache vendor advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. If immediate patching is not feasible, disable HTTP/2 on the origin-facing side of ATS to eliminate the HTTP/2-to-HTTP/1 downgrade path entirely - this removes the vulnerable code path but sacrifices HTTP/2 multiplexing and header compression benefits for origin connections, potentially increasing latency and connection overhead. Alternatively, if infrastructure permits, enforcing end-to-end HTTP/2 (requiring HTTP/2-capable clients) avoids the protocol translation entirely but may break compatibility with legacy HTTP/1 clients. Neither workaround addresses the root cause; patching is the only durable fix.