Apache Traffic Server truncates over-long header names, creating a header alias that downstream systems interpret separately. Based on the description, it is inferred that an attacker can send malformed HTTP requests with oversized header names to trigger this truncation. This aliasing allows embedding a second request within the same network flow, enabling request smuggling and bypass of policy checks that rely on header name uniqueness. The flaw is identified as CWE‑444.

Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. Any deployment of these releases is vulnerable to the described attack vector.

The CVSS base score of 9.2 indicates a high severity of potential impact. The EPSS score is below 1%, suggesting a low likelihood of exploitation at present, and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers can remotely send malformed HTTP requests with oversized header names to engineer request smuggling or policy bypass against upstream services. The primary attack vector is via the transport layer, requiring no additional privileged access and exploiting only the server’s header parsing logic.