HTTP Request Smuggling Vulnerability in Apache Traffic Server
CVE-2026-24033

6.9MEDIUM

Key Information:

Vendor

Apache
Status
Apache Traffic Server
Vendor
CVE Published:
29 July 2026

What is CVE-2026-24033?

A vulnerability in Apache Traffic Server permits inconsistent interpretation of HTTP requests, leading to potential HTTP Request/Response Smuggling. This flaw impacts versions from 9.0.0 to 9.2.14 and 10.0.0 through 10.1.3. The recommended course of action for users is to upgrade to versions 9.2.15 or 10.1.4, which address this security issue.

Affected Version(s)

Apache Traffic Server 10.0.0 <= 10.1.3

Apache Traffic Server 9.0.0 <= 9.2.14

References

https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnoky...
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rajat Raghav
Katsutoshi Ikenoya (LY Corporation)
.