CVE-2026-58150

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3

Description Apache Traffic Server fails to reject the Transfer-Encoding header in HTTP/2 requests. This behavior allows for downgrade request smuggling, a technique where an attacker manipulates the request stream to confuse the proxy and the backend server about where a request ends and a new one begins.

Recommendations Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.