Inconsistent Interpretation of HTTP Requests Vulnerability in Apache APISIX
CVE-2024-32638

6.3MEDIUM

Key Information:

Vendor
Apache
Status
Apache Apisix
Vendor
CVE Published:
2 May 2024

Badges

📰 News Worthy

Summary

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using forward-auth plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0.

Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.

Affected Version(s)

Apache APISIX 3.8.0 <= 3.9.0

News Articles

favicon imageprophaze.com

CVE-2024-32638 : APACHE APISIX 3.8.0/3.9.0 FORWARD-AUTH PLUGIN REQUEST SMUGGLING - Cloud WAF

CVE-2024-32638 : Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.

References

https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225k...
vendor-advisory
http://www.openwall.com/lists/oss-security/2024/05/02/2

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 📰

    First article discovered by prophaze.com

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered and reported by Brandon Arp and Bruno Green of Topsort.
.