CVE-2024-53868

Description

Apache Traffic Server allows request smuggling if chunked messages are malformed.  This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issue.

Reserved 2024-11-22 | Published 2025-04-03 | Updated 2025-04-18 | Assigner apache

Problem types

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Product status

Default status
unaffected

9.2.0
affected

10.0.0
affected

Credits

Jeppe Bonde Weikop reporter

References

lists.apache.org/thread/rwyx91rsrnmpjbm04footfjjf6m9d1c9 vendor-advisory

cve.org (CVE-2024-53868)

nvd.nist.gov (CVE-2024-53868)

Download JSON