Apache Community

Request smuggling is possible via HEAD requests that include `Content-Length` or `Transfer-Encoding` headers.

The proxy writes one unthrottled diagnostic log line for every internal `@` header it strips. Consequently, a request containing a large number of these headers causes the proxy to generate significantly more log data than the actual size of the request.

The experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.

The `origin server auth` plugin allows a client to force the signing of attacker-chosen AWS request headers using the proxy's own credentials.

The experimental wasm plugin contains a use-after-free flaw within its transaction-close handler. Additionally, the plugin forwards unvalidated metric IDs provided by the guest to the internal stats API.

An unauthenticated client can control ImageMagick convert arguments through the experimental magick plugin when using the default unsigned configuration. This issue may allow cache poisoning and request smuggling.

The software forwarded a malformed 302 response that should have been rejected as a parse error. This occurred because the `Transfer-Encoding: chunked` carve-out bypassed the rejection path. Consequently, a response that two peers can interpret differently is stored and served, leading to cache poisoning and response-framing desync.

An improper access control issue exists where SNI-to-Host access control is not enforced. Approximately 311,500 instances are identified globally.

When converting HTTP/2 to HTTP/1, the software forwards HTTP/2 origin trailers to HTTP/1 clients without applying the necessary chunked framing. Chunked framing is a mechanism in HTTP/1.1 that allows a server to send data as a series of chunks, which is required to properly transmit trailers (additional headers sent after the main body).

Apache Traffic Server contains memory-safety errors that allow the system to write out of bounds or overflow integers during the parsing of MIME and HTTP headers.

Apache Traffic Server mis-parses ports in URLs and userinfo, which allows for a port-based access-control bypass.

Apache Traffic Server drops the per-stream buffer cap during the dechunking of HTTP/2 or HTTP/3 responses. This behavior allows a slow client to exhaust the server memory.

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying that the server certificate covers the hostname of the new request.

Apache Traffic Server improperly reuses server sessions and tunnels, which can lead to data exposure across different client connections.

Apache Traffic Server mishandles PROXY protocol input, which leads to the truncation of ports and a stack overflow. A stack overflow occurs when a program uses more stack space than is available, potentially causing the application to crash.

IP access controls can be bypassed on UDS listeners and through ACL matching errors.

An out-of-bounds read occurs during the parsing of DNS answers.

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, which can lead to state corruption or system crashes.

Use-after-free and time-of-check/time-of-use errors exist in the remap configuration handling. Use-after-free occurs when a program continues to use a pointer after it has been freed, and time-of-check/time-of-use is a race condition where a resource is modified between the time it is checked and the time it is used.

The Cripts framework contains out-of-bounds writes, path traversal, and use-after-free errors. Out-of-bounds writes occur when data is written outside the boundary of a fixed-length block of memory. Path traversal allows access to files and directories outside the intended folder. Use-after-free happens when a program continues to use a pointer after it has been freed.