This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Apache Traffic Server fixes 34 vulnerabilities

Apache fixes 34 vulnerabilities in Apache Traffic Server (ATS) in versions 9.2.15 and 10.1.4. Selected critical vulnerabilities are described below; the others can be found at [1].

Apache Traffic Server - request smuggling, metadata injection (CVE-2026-33267)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can, by sending specially crafted hop-by-hop headers (listed in Connection) or internal headers with the @ prefix, which ATS does not strip from an untrusted peer, perform request smuggling and spoof internal metadata. [2][1]

The vulnerability is present in product:

  • Apache Traffic Server; >=9.2.0, <=9.2.14; >=10.1.0, <=10.1.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 29. 7. 2026.

Apache Traffic Server - downgrade request smuggling (CVE-2026-58150)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can, by sending HTTP/2 requests with a Transfer-Encoding header that ATS does not reject, perform a downgrade request smuggling attack during HTTP/2 to HTTP/1.1 translation. [3][1]

The vulnerability is present in product:

  • Apache Traffic Server; >=8.0.0, <=8.1.9; >=9.0.0, <=9.2.14; >=10.0.0, <=10.1.13;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 29. 7. 2026.

Apache Traffic Server - request smuggling, policy bypass (CVE-2026-58155)
CVSS 9.3 (Critical)

An unauthenticated remote attacker can, due to the truncation of overly long header names, cause header name collisions (header aliasing), perform request smuggling and bypass security policies. [4][1]

The vulnerability is present in product:

  • Apache Traffic Server; >=8.0.0, <=8.1.9; >=9.0.0, <=9.2.14; >=10.0.0, <=10.1.13;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

More information:

The vulnerability was publicly disclosed 29. 7. 2026.

By CESNET, z.s.p.o. Táňa Macháčková on 30. 7. 2026.

CESNET, z.s.p.o. Logo