Katsutoshi Ikenoya

An issue exists involving the inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling. This occurs due to the parsing of quoted-strings within chunked extensions.

Apache Traffic Server is susceptible to request smuggling, a technique where an attacker interferes with the way a website and its proxy server process sequences of HTTP requests, when chunked messages are malformed.

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.2.12 and 10.0.0 through 10.1.1 Description Apache Traffic Server is susceptible to request smuggling when handling malformed chunked messages. This can potentially lead to various security issues. Recommendations Upgrade to version 9.2.13 or 10.1.2.

The issue is caused by improper input validation in the Range Header Handler component of the Apache Traffic Server. This can be exploited by a remote attacker to cause a denial of service.

The issue is caused by improper input validation in the HTTP/2 component of Apache Traffic Server. This allows a remote attacker to cause a denial of service.