Description
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Published: 2026-07-29
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Apache Traffic Server does not reject Transfer‑Encoding in HTTP/2 requests, allowing an attacker to perform downgrade request smuggling. The flaw permits HTTP/2 traffic with a Transfer‑Encoding header to be treated as multiple or malformed requests by the server, which can lead to the manipulation of request handling under the control of the attacker.

Affected Systems

Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected by this flaw.

Risk and Exploitability

The CVSS score of 7.8 signifies a high severity vulnerability. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an external actor with network access able to forge HTTP/2 requests that contain a Transfer‑Encoding header and send them to an Apache Traffic Server instance.

Generated by OpenCVE AI on August 4, 2026 at 23:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 to apply the fix for Transfer‑Encoding handling.
  • If immediate upgrade is not possible, configure perimeter devices such as firewalls or reverse proxies to block or drop HTTP/2 requests that include a Transfer‑Encoding header.
  • Continuously monitor server logs for anomalous Transfer‑Encoding header usage to detect potential smuggling attempts.

Generated by OpenCVE AI on August 4, 2026 at 23:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Title Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
Weaknesses CWE-444
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

cvssV4_0

{'score': 7.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-30T03:55:15.616Z

Reserved: 2026-06-29T15:31:25.334Z

Link: CVE-2026-58150

cve-icon Vulnrichment

Updated: 2026-07-29T13:17:29.288Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-29T08:16:31.710

Modified: 2026-08-03T13:42:21.757

Link: CVE-2026-58150

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T23:30:15Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')