Apache Traffic Server processes HTTP/1.1 chunked requests in a way that allows a malformed chunked message body to be interpreted incorrectly, making it possible for an attacker to smuggle multiple logical HTTP requests into a single physical one. This vulnerability can be leveraged to bypass access controls, inject malicious traffic, or conduct denial-of-service attacks, thereby compromising the confidentiality, integrity, or availability of the services behind the proxy.

The vulnerability affects Apache Traffic Server from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.

The CVSS score of 7 indicates a moderate to high severity, and the EPSS score of less than 1% shows low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to send a specially crafted HTTP request with a malformed chunked body to a reachable Traffic Server instance, making the likely attack vector remote over the network. Once exploited, the attacker can smuggle additional requests, potentially bypassing security mechanisms behind the proxy.