Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-35161: Apache Traffic Server may allow request smuggling

CVE-2024-35161 · published 2 years ago

Summary

Versions 8.0.0 through 8.1.10 and 9.0.0 through 9.2.4 can pass malformed data sections to the original web server, which can be used to hide or alter requests. This could let attackers trick the server into processing false requests or corrupt cached content. Update to version 8.1.11 or 9.2.5, or enable the setting to drop these data sections, to stop the problem.

What to do

Update debian trafficserver to version 9.2.5+ds-0+deb12u1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	trafficserver	< 9.2.5+ds-0+deb12u1 Fix: upgrade to 9.2.5+ds-0+deb12u1
–	apache	traffic_server	>= 8.0.0, < 8.1.11 >= 9.0.0, < 9.2.5 `cpe:2.3:a:apache:traffic_server::::::::`

Original advisory text

Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling

Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked trailer section. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35161... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-35161 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2024-35161 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html URL
https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Timeline

Published26 Jul 2024

Updated3 Nov 2026

First seen1 Sep 2026

Sources

DEBIAN-CVE-2024-35161 · OSV

CVE-2024-35161 · NVD

CVE-2024-35161 · OSV

Track software like this

Free during beta