CVE-2026-58155: Apache Traffic Server Auth Bypass Flaw

CVE-2026-58155 Overview

CVE-2026-58155 affects Apache Traffic Server (ATS), a widely deployed forward and reverse HTTP proxy cache. The proxy truncates over-long HTTP header names during parsing. This truncation allows attackers to alias distinct headers to the same effective name, enabling HTTP request smuggling and policy bypass across proxy and origin boundaries.

The issue is classified under CWE-444, Inconsistent Interpretation of HTTP Requests. Header aliasing lets attackers smuggle requests past authentication filters, cache boundaries, and security policies enforced at the proxy layer.

Critical Impact
Remote, unauthenticated attackers can smuggle HTTP requests, poison caches, and bypass security policies enforced by Apache Traffic Server.

Affected Products

Apache Traffic Server 8.0.0 through 8.1.9
Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3

Discovery Timeline

2026-07-29 - CVE-2026-58155 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-58155

Vulnerability Analysis

Apache Traffic Server parses inbound HTTP requests and forwards them to origin servers or downstream caches. The parser imposes a maximum length on header field names. When a client submits a header name that exceeds this limit, ATS truncates the name rather than rejecting the request.

Truncation converts distinct header names into identical shorter strings. A crafted header such as Content-Length-Padding-XXXX... can collapse into Content-Length once truncated. The origin server, which enforces different or no length limits, sees the untruncated name. The two hops now disagree on which headers are authoritative.

This parser disagreement is the classical precondition for HTTP request smuggling. Attackers can also alias security-relevant headers such as Authorization, Host, or X-Forwarded-For to bypass access controls that inspect the shorter forms.

Root Cause

The root cause is silent truncation of header field names during HTTP message parsing. RFC 9110 requires proxies to reject malformed or oversized fields rather than mutate them. ATS instead accepts the request with a shortened name, producing semantic drift between the proxy and origin views of the message.

Attack Vector

Exploitation requires only network access to the proxy. No authentication, user interaction, or elevated privileges are needed. An attacker crafts an HTTP request containing header names padded beyond the ATS length threshold and sends it to any endpoint fronted by a vulnerable Traffic Server. The proxy truncates the names, forwards the request, and the origin interprets the smuggled semantics. Full technical discussion is available in the Apache Security Mailing List Thread.

Detection Methods for CVE-2026-58155

Indicators of Compromise

HTTP requests containing header field names longer than 1024 bytes reaching ATS listeners.
Requests with duplicate or conflicting Content-Length, Transfer-Encoding, or Host headers observed at the origin but not at the proxy.
Unexpected cache hits for authenticated resources served to unauthenticated clients.
Origin logs showing header names that appear valid but do not match the shortened names logged by ATS.

Detection Strategies

Compare access logs between Traffic Server and origin servers for header field mismatches on the same request ID.
Deploy a WAF or reverse proxy rule that rejects any request containing header names longer than 256 bytes before it reaches ATS.
Alert on any HTTP/1.1 request containing both Transfer-Encoding and Content-Length after passing through the proxy.

Monitoring Recommendations

Ingest ATS traffic.out and origin access logs into a centralized SIEM and correlate request pairs on connection identifiers.
Track the ATS version banner across the fleet to identify hosts still running 8.x, 9.x below 9.2.15, or 10.x below 10.1.4.
Baseline normal header-name length distributions and alert on statistical outliers.

How to Mitigate CVE-2026-58155

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 without delay.
Retire any deployments still running the 8.x branch, which has reached end of support relative to this fix.
Audit downstream origins for evidence of smuggled or aliased requests during the exposure window.

Patch Information

The Apache Traffic Server project released fixed versions 9.2.15 and 10.1.4. These builds reject over-long header names instead of truncating them. Consult the Apache Security Mailing List Thread for release artifacts and integrity hashes.

Workarounds

Place a strict HTTP parser such as a hardened WAF in front of ATS and drop requests with header names longer than 256 bytes.
Disable HTTP/1.1 pipelining and keep-alive reuse on upstream connections to reduce smuggling reliability.
Enforce identical header-length limits at both the proxy and origin to eliminate parser drift.

bash

# Example nginx front-end rule to reject oversized header names before ATS
large_client_header_buffers 4 8k;
if ($http_x_long_header_probe) { return 400; }