CVE-2026-58150: Apache Traffic Server Smuggling Flaw

CVE-2026-58150 Overview

CVE-2026-58150 affects Apache Traffic Server (ATS), a widely deployed reverse proxy and caching HTTP server. The vulnerability allows HTTP request smuggling through HTTP/2 downgrade requests because ATS does not reject the Transfer-Encoding header in HTTP/2 requests. Attackers can exploit this discrepancy between HTTP/2 and HTTP/1.1 message framing to smuggle requests to upstream servers. The flaw is classified under CWE-444: Inconsistent Interpretation of HTTP Requests. Impacted versions span 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Critical Impact
Remote unauthenticated attackers can smuggle HTTP requests past security controls, poison caches, hijack sessions, and bypass access restrictions enforced at the proxy layer.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58150 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58150

Vulnerability Analysis

Apache Traffic Server accepts HTTP/2 requests that include a Transfer-Encoding header. RFC 9113 explicitly forbids Transfer-Encoding in HTTP/2 because HTTP/2 uses its own binary framing for message boundaries. When ATS forwards these requests to an HTTP/1.1 backend, the presence of Transfer-Encoding: chunked alongside a Content-Length header creates ambiguity in message framing.

The front-end proxy and the back-end origin server disagree on where one request ends and the next begins. This desynchronization lets an attacker append a second, hidden request that the backend processes as originating from another user's connection. The smuggled request can steal credentials, poison shared caches, or bypass authentication controls at the proxy.

Root Cause

The root cause is missing input validation of prohibited HTTP/2 headers. ATS fails to strip or reject the Transfer-Encoding header when translating HTTP/2 frames to HTTP/1.1 messages for upstream forwarding. This creates the classic H2.TE downgrade smuggling primitive documented in HTTP desync research.

Attack Vector

An attacker sends an HTTP/2 request to a vulnerable ATS instance with a crafted Transfer-Encoding: chunked header and a conflicting Content-Length value. ATS downgrades the request to HTTP/1.1 and forwards it upstream, where the backend uses Transfer-Encoding to parse the body. The unparsed remainder is treated as the start of a new request on the reused connection, letting the attacker prepend arbitrary content to a victim's next request.

The vulnerability requires no authentication and can be triggered remotely over the network. See the Apache Security Advisory for the vendor's technical description.

Detection Methods for CVE-2026-58150

Indicators of Compromise

HTTP/2 requests received by ATS containing a Transfer-Encoding header, which is prohibited by RFC 9113.
Unexpected paired HTTP responses on the upstream connection, indicating a smuggled request was processed.
Cache entries containing responses whose URIs do not match the request path recorded by ATS access logs.
Backend access logs showing requests without a corresponding front-end log entry on the same connection.

Detection Strategies

Enable protocol-conformance logging on ATS and alert whenever HTTP/2 frames carry the Transfer-Encoding pseudo-header.
Deploy a web application firewall rule that blocks HTTP/2 requests containing Transfer-Encoding.
Correlate front-end and origin access logs to identify request count or URI mismatches on individual TCP connections.
Monitor for anomalous cache poisoning behavior such as authenticated responses served to unauthenticated clients.

Monitoring Recommendations

Track the deployed ATS version across the fleet and confirm every instance is at 9.2.15, 10.1.4, or later.
Capture and inspect HTTP/2 request headers at ingress for prohibited framing headers.
Alert on sudden increases in 400-class responses from upstream servers, which often accompany smuggling attempts.

How to Mitigate CVE-2026-58150

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, which contain the vendor fix.
Inventory all reverse proxies and CDN edge nodes running affected 8.x, 9.x, or 10.x builds.
Deploy an interim WAF rule that drops HTTP/2 requests containing the Transfer-Encoding header.
Rotate session cookies and API tokens if evidence of request smuggling is discovered.

Patch Information

The Apache Traffic Server project addressed CVE-2026-58150 in versions 9.2.15 and 10.1.4. Users on the 8.x line have no fixed release and should migrate to a supported branch. Details are available in the Apache Security Advisory.

Workarounds

Disable HTTP/2 termination at the ATS layer until the patched version is deployed.
Terminate HTTP/2 upstream of ATS on a proxy that strips prohibited headers before forwarding.
Configure ATS to close upstream connections after each request, eliminating the connection reuse that smuggling exploits.

bash

# Interim mitigation: disable HTTP/2 on ATS listeners in records.config
CONFIG proxy.config.http2.enabled INT 0

# Force upstream connections to close, preventing reuse-based smuggling
CONFIG proxy.config.http.keep_alive_enabled_out INT 0