PT-2026-82448

CVE-2026-74848

Published

2026-08-27

Updated

2026-09-01

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.12.0 through 3.17.0

Description An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, occurs on serverless-plugin routes. This allows an attacker to manipulate the request stream so that other clients receive responses chosen by the attacker or responses intended for other users.

Recommendations Upgrade to version 3.18.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Xclow3N

Vendors

Affected products

Weakness enumeration

CWE-444: Inconsistent Interpretation of HTTP Requests (\'HTTP Request/Response Smuggling\')

Related identifiers