by Kastro
Paper/Archive/CVE-2026-58150

CVE-2026-58150

Apache Software Foundation Apache Traffic Server — Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling

EPSS 0.6%CVSS 10.0
critical.is priorityof 100
39
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 47.0.470 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Affected

ProductAffectedFixed inSource
Apache Traffic Server8.0.0 – 8.1.11–CNA
Apache Traffic Server9.0.0 – 9.2.14–CNA
Apache Traffic Server10.0.0 – 10.1.3–CNA

Scores by source

apache (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
apache (CNA)7.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d