Description
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Published: 2026-07-29
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing during conversion, causing malformed responses that can reveal trailer data or lead to client crashes. This flaw is identified as CWE‑444.

Affected Systems

Apache Traffic Server versions 10.0.0 through 10.1.3 are affected. Users running any of these releases should be aware that HTTP/2 trailers may reach downstream HTTP/1 clients and cause data leakage or service instability.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to send a crafted HTTP/2 request containing trailers; Traffic Server then forwards these trailers to HTTP/1 clients, which requires a remote network‑based attack. Given the limited exploitation path and low EPSS, the risk is moderate but can result in data leakage or denial of service if leveraged.

Generated by OpenCVE AI on August 4, 2026 at 23:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to version 10.1.4 or 9.2.15, which includes proper handling of HTTP/2 origin trailers.
  • If an upgrade cannot yet be performed, configure Traffic Server to drop or ignore HTTP/2 origin trailers so that malformed data does not reach HTTP/1 clients.
  • After applying the fix or configuration change, test HTTP/1 clients against chunked responses to confirm that trailers are no longer forwarded and client errors are eliminated.

Generated by OpenCVE AI on August 4, 2026 at 23:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
Description Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Title Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely
Weaknesses CWE-444
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-29T13:29:30.157Z

Reserved: 2026-06-29T15:34:03.148Z

Link: CVE-2026-58153

cve-icon Vulnrichment

Updated: 2026-07-29T13:29:26.873Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-29T09:16:29.613

Modified: 2026-08-03T13:41:54.987

Link: CVE-2026-58153

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T00:00:03Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')