EUVD-2026-50209
GHSA-9jfm-2xhc-ghxj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated HTTP request (AV:N/AC:L/PR:N/UI:N); smuggling crosses the proxy trust boundary (S:C) with high integrity impact from policy bypass and limited confidentiality exposure, no availability effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Articles & Coverage 1
AnalysisAI
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy silently truncates over-long HTTP header names, causing two distinct header names to alias to the same value. A network attacker can exploit this desynchronization to smuggle requests past the proxy and bypass security or routing policy. No public exploit has been identified at time of analysis, but the CVSS 9.3 rating and CWE-444 classification mark this as a high-priority proxy integrity flaw affecting a core CDN/caching component.
Technical ContextAI
Apache Traffic Server is a high-performance forward and reverse HTTP/HTTPS caching proxy widely used as CDN edge and origin-shield infrastructure. The root cause is CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling): when a header name exceeds the parser's length limit, ATS truncates the name rather than rejecting the message, so distinct headers collapse to the same effective name ('header aliasing'). Because ATS and its upstream/downstream endpoints then disagree about which header value applies, request boundaries and security-relevant headers (e.g., routing, auth, or filtering headers) can be reinterpreted. The single CPE (cpe:2.3:a:apache_software_foundation:apache_traffic_server:*) confirms the affected product is the ATS proxy itself, not a bundled library.
RemediationAI
Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x branch) or 10.1.4 (for the 10.x branch), per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Users on the affected 8.0.0-8.1.9 branch have no listed 8.x fixed release and should migrate to 9.2.15 or 10.1.4. As a compensating control until patching, place a strict HTTP header-validation layer in front of ATS (e.g., a WAF or upstream proxy) configured to reject requests containing abnormally long header names rather than truncating them, and disable HTTP connection reuse/keep-alive to origins where feasible to reduce smuggling opportunity - noting this reduces throughput and increases origin connection load. Restricting who can reach the proxy does not mitigate this, since the attack is unauthenticated over the normal HTTP path.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today