Apache Traffic Server historically truncates header names that exceed the maximum allowed length. When the truncated key is used, the server creates a header alias that different downstream systems interpret separately, enabling an attacker to embed a second request within the same network flow. This mechanism, identified as CWE‑444, permits request smuggling and the bypass of policy checks that rely on header name uniqueness.

The vulnerability exists in Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Any deployment of these releases is susceptible to the described attack vector.

The CVSS base score of 9.2 indicates a high severity of potential impact. The EPSS score is below 1%, suggesting a low likelihood of exploitation at present, and the flaw is not listed in CISA’s KEV catalog. Attackers can remotely send malformed HTTP requests with oversized header names to engineer request smuggling or policy bypass against upstream services. The primary attack vector is via the transport layer, requiring no additional privileged access and exploiting only the server’s header parsing logic.