High severity · published Jul 26, 2024
CVE-2024-35161
Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers
7.5
CVSS
1%
EPSS
No
On KEV
Description
Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.
Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked trailer section.
Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Traffic Server · Apache
8.0.0 before 8.1.11; 9.0.0 before 9.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-35161
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-35161
Mailing List
https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html
More from Traffic Server
10.0
CVE-2026-58162
Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates
10.0
CVE-2026-58150
Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
10.0
CVE-2026-57834
Apache Traffic Server: Malformed chunked message body allows request smuggling
9.8
CVE-2026-58185
Apache Traffic Server: Use-after-free in the intercept plugin
9.8
CVE-2026-58179
Apache Traffic Server: regex_remap plugin overflows the stack from attacker input