Skip to content
CVSS 9.3 · CRITICAL

CVE-2026-58155Request Smuggling crítico en Apache Traffic Server

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Ver en NVD

Análisis

Apache Traffic Server (ATS) is vulnerable to critical request smuggling and policy bypass. Attackers can exploit improper header name truncation to bypass security filters or alias headers, potentially compromising the integrity of backend communications.

Severidad

Puntaje: 9.3(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: CHANGED
C: LOW
I: HIGH
A: NONE
Tipo de falla (CWE): CWE-444

EPSS

Sin puntaje EPSS aún (CVE muy reciente).

Descripción técnica

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Publicada: 29/7/2026, 9:16:29
Última modificación: 29/7/2026, 9:16:29

Referencias

InicioEventosBlogRecursosCursosEquipo