CVE-2024-35296: Apache Traffic Server DoS Vulnerability

CVE-2024-35296 Overview

CVE-2024-35296 is an input validation flaw in Apache Traffic Server (ATS), an open-source caching proxy used by large-scale content delivery deployments. An attacker can send an invalid Accept-Encoding header to cause the cache lookup to fail, forcing the proxy to forward the request to the origin server instead of serving cached content. This bypass of cache logic enables origin overload conditions and can be used to degrade availability and tamper with cache integrity. The issue affects Apache Traffic Server 8.0.0 through 8.1.10 and 9.0.0 through 9.2.4. Apache addressed the flaw in versions 8.1.11 and 9.2.5. The weakness is tracked under [CWE-20] Improper Input Validation.

Critical Impact
Unauthenticated remote attackers can bypass cache lookups by sending malformed Accept-Encoding headers, forcing origin forwarding and enabling cache integrity and availability attacks.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.10
Apache Traffic Server 9.0.0 through 9.2.4
Debian LTS distributions packaging affected Apache Traffic Server versions

Discovery Timeline

2024-07-26 - CVE-2024-35296 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35296

Vulnerability Analysis

Apache Traffic Server uses the Accept-Encoding request header to determine which cached variant of a resource to return. When the proxy receives a malformed value in this header, the cache lookup logic fails to match a valid stored object. Instead of returning an error or normalizing the input, the proxy treats the lookup as a miss and forwards the request directly to the origin server.

An unauthenticated attacker can exploit this behavior over the network with low complexity and no user interaction. Repeated requests carrying crafted Accept-Encoding headers compel the proxy to bypass the cache for every transaction. This breaks the performance and protective role of the caching tier and exposes the origin to traffic volumes it was not provisioned to handle.

The impact maps to integrity and availability rather than confidentiality. Cache bypass allows attackers to influence which content the origin serves and to amplify request load against backend systems.

Root Cause

The root cause is improper input validation [CWE-20] in the Accept-Encoding header parsing path. Apache Traffic Server does not reject or normalize syntactically invalid encoding tokens before they reach the cache key resolution logic. The invalid value causes the lookup to fail rather than fall back to a safe default.

Attack Vector

Exploitation requires only the ability to send HTTP requests to a vulnerable Apache Traffic Server instance. The attacker crafts an HTTP request containing a malformed Accept-Encoding header value. Each such request forces the proxy to forward to the origin, regardless of cache state. Attackers can chain this with high request rates to produce denial-of-service against the origin or to manipulate cache freshness behavior.

No verified public exploit code was available at the time of writing. See the Apache Mailing List Update for the vendor description of the issue.

Detection Methods for CVE-2024-35296

Indicators of Compromise

Spikes in origin-bound traffic from the Apache Traffic Server tier with a corresponding drop in cache hit ratio.
HTTP requests containing malformed, non-standard, or unexpected token sequences in the Accept-Encoding header.
Repeated requests for the same URL from a single client with varying or invalid Accept-Encoding values.

Detection Strategies

Parse Apache Traffic Server access logs for requests where Accept-Encoding deviates from RFC 9110 token grammar.
Alert when cache miss rates for a given URL or virtual host exceed historical baselines.
Correlate origin server request volume against proxy cache statistics to detect forced bypass patterns.

Monitoring Recommendations

Ingest Apache Traffic Server squid.log or extended2.log into a centralized analytics platform for header inspection.
Track cache hit ratio, origin request rate, and unique Accept-Encoding value cardinality as continuous metrics.
Configure WAF or upstream load balancer rules to flag requests carrying non-standard encoding tokens.

How to Mitigate CVE-2024-35296

Immediate Actions Required

Upgrade Apache Traffic Server to version 8.1.11 or 9.2.5 or later as identified by the Apache Software Foundation.
Inventory all Apache Traffic Server instances and confirm running versions against the affected ranges.
Apply Debian LTS package updates referenced in the Debian LTS Security Announcement where applicable.

Patch Information

The Apache Software Foundation released fixed builds in Apache Traffic Server 8.1.11 and 9.2.5. These releases correct the Accept-Encoding header handling so that invalid values no longer force a cache lookup failure. Vendor details are published in the Apache Mailing List Update.

Workarounds

Deploy a Web Application Firewall (WAF) rule upstream of Apache Traffic Server to reject or normalize requests with malformed Accept-Encoding headers.
Rate-limit clients producing high volumes of cache-miss requests until patched builds are deployed.
Restrict direct exposure of the proxy to untrusted networks where operationally feasible.

bash

# Example: verify installed Apache Traffic Server version against fixed releases
traffic_server --version

# Debian/Ubuntu upgrade path
sudo apt-get update
sudo apt-get install --only-upgrade trafficserver