High severity · published Jul 26, 2024
CVE-2024-35161
Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling
7.5
CVSS
1%
EPSS
No
On KEV
Description
Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.
Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked trailer section.
Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Apache Traffic Server · Apache Software Foundation
8.0.0 through 8.1.10; 9.0.0 through 9.2.4 · source: vendor
TS
Traffic Server · Apache
8.0.0 before 8.1.11; 9.0.0 before 9.2.5 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-35161
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-35161
Mailing List
https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html
More from Apache Traffic Server
10.0
CVE-2026-111812
Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
10.0
CVE-2026-111815
Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
10.0
CVE-2026-111814
Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
10.0
CVE-2026-111813
Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
10.0
CVE-2026-58162
Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates