by Kastro
Paper/Archive/CVE-2026-57834

CVE-2026-57834

Apache Software Foundation Apache Traffic Server — Apache Traffic Server: Malformed chunked message body allows request smuggling

EPSS 0.6%CVSS 10.0
critical.is priorityof 100
40
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 49.0.490 × 209.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Affected

ProductAffectedFixed inSource
Apache Traffic Server8.0.0 – 8.1.11–CNA
Apache Traffic Server9.0.0 – 9.2.14–CNA
Apache Traffic Server10.0.0 – 10.1.3–CNA

Scores by source

apache (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
apache (CNA)7.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d