CVE-2026-58153: Apache Traffic Server DOS Vulnerability

CVE-2026-58153 Overview

CVE-2026-58153 affects Apache Traffic Server (ATS), a widely deployed caching proxy used in front of origin web servers. The vulnerability occurs when ATS converts HTTP/2 responses from origin servers to HTTP/1 responses for downstream clients. ATS forwards HTTP/2 origin trailers to HTTP/1 clients without applying proper chunked transfer-encoding framing. This framing mismatch enables HTTP request/response smuggling conditions described under [CWE-444]. Affected releases include Apache Traffic Server 10.0.0 through 10.1.3. Fixed builds are available in versions 9.2.15 and 10.1.4.

Critical Impact
Improper trailer framing during HTTP/2-to-HTTP/1 downgrade can desynchronize proxy and client parsers, enabling response smuggling and cache poisoning against downstream consumers.

Affected Products

Apache Traffic Server 10.0.0 through 10.1.3
Apache Traffic Server 9.x branch prior to 9.2.15
Deployments performing HTTP/2 origin connections with HTTP/1 client termination

Discovery Timeline

2026-07-29 - CVE-2026-58153 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58153

Vulnerability Analysis

Apache Traffic Server acts as a protocol-translating reverse proxy. When an origin serves an HTTP/2 response containing trailers, ATS must convert that response into an HTTP/1 message before forwarding to an HTTP/1 client. HTTP/1 requires trailers to appear only inside a Transfer-Encoding: chunked message and to follow the terminating zero-length chunk. ATS forwards the trailer fields without ensuring the response uses chunked framing. The resulting byte stream contains header-like data after the message body that HTTP/1 clients and intermediaries cannot interpret consistently. This condition is classified as an HTTP Request/Response Smuggling weakness under [CWE-444].

Root Cause

The root cause is missing framing enforcement in the HTTP/2 to HTTP/1 downgrade path. ATS emits origin trailer fields to the client socket without verifying that the outgoing HTTP/1 response advertises chunked transfer encoding. Content-Length responses and identity-encoded responses cannot carry trailers in HTTP/1. Emitting trailers in that context produces malformed output that parsers may either drop, treat as a subsequent response, or interpret as smuggled header data.

Attack Vector

An attacker controlling or influencing an origin response can inject trailer fields that ATS forwards verbatim. Downstream HTTP/1 clients, caches, or additional proxies may parse the trailing bytes as a second response or as headers for a follow-up request. This desynchronization enables response queue poisoning, cache poisoning against shared caches, and injection of attacker-controlled headers into responses intended for other users. The vulnerability requires no authentication and is reachable over the network wherever ATS terminates HTTP/1 clients against HTTP/2 origins.

No public proof-of-concept is available. See the Apache Mailing List Discussion for maintainer notes on the fix.

Detection Methods for CVE-2026-58153

Indicators of Compromise

HTTP/1 responses emitted by ATS containing header-like lines after the message body without chunked framing.
Downstream cache entries containing unexpected header fields or duplicated status lines.
Client parser errors or connection resets clustered on endpoints proxied through ATS 10.0.0 through 10.1.3.

Detection Strategies

Inventory ATS deployments and identify instances running versions 10.0.0 through 10.1.3 or 9.x below 9.2.15.
Capture responses at the client-facing edge and inspect for trailer fields emitted outside chunked responses.
Compare origin HTTP/2 trailer presence against ATS client-facing response framing using traffic mirroring.

Monitoring Recommendations

Log ATS response headers including Transfer-Encoding and Content-Length per transaction and alert on responses that contain trailer sections without Transfer-Encoding: chunked.
Monitor downstream caches for entries whose bodies contain HTTP header syntax.
Track parser error rates on load balancers and CDNs positioned in front of ATS.

How to Mitigate CVE-2026-58153

Immediate Actions Required

Upgrade Apache Traffic Server to version 10.1.4 for the 10.x branch or 9.2.15 for the 9.x branch.
Audit reverse-proxy topologies to identify any ATS instances converting HTTP/2 origins to HTTP/1 clients.
Restart ATS after upgrade and verify the running build version matches the fixed release.

Patch Information

The Apache Traffic Server project fixed the framing behavior in releases 9.2.15 and 10.1.4. Both releases correct the HTTP/2-to-HTTP/1 conversion path so that origin trailers are either dropped or emitted only within a properly chunked HTTP/1 response. Details are available in the Apache Mailing List Discussion.

Workarounds

Disable HTTP/2 on origin connections so ATS negotiates HTTP/1 end-to-end and cannot receive HTTP/2 trailers.
Configure origins to omit trailer fields from responses served through ATS.
Terminate HTTP/1 clients on a downstream proxy that strips trailer fields before caching or forwarding.

bash

# Configuration example: force HTTP/1 to origins in records.yaml
ts:
  http2:
    no_server: 1
  ssl:
    client:
      # Restrict ALPN offered to origins to HTTP/1.1 only
      alpn_protocols: http/1.1