CVE-2026-74848: Apache APISIX HTTP Smuggling Vulnerability

CVE-2026-74848 Overview

CVE-2026-74848 is an HTTP Request/Response Smuggling vulnerability in Apache APISIX affecting versions 2.12.0 through 3.17.0. The flaw stems from inconsistent interpretation of HTTP requests [CWE-444] on routes configured with serverless plugins. An attacker sending crafted HTTP requests can cause other clients to receive attacker-chosen responses or responses intended for different users. The issue affects response integrity and cross-user data confidentiality on impacted routes. Apache resolved the issue in Apache APISIX 3.18.0.

Critical Impact
Attackers can poison responses on serverless-plugin routes so unrelated clients receive attacker-controlled or other users' HTTP responses.

Affected Products

Apache APISIX 2.12.0 through 3.17.0
Deployments using serverless-plugin routes (serverless-pre-function, serverless-post-function)
API gateway installations exposing APISIX to untrusted HTTP clients

Discovery Timeline

2026-08-27 - CVE-2026-74848 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74848

Vulnerability Analysis

Apache APISIX is an open-source, dynamic API gateway that routes and processes HTTP traffic between clients and upstream services. The vulnerability arises when APISIX and adjacent HTTP components disagree on how a single HTTP request stream is parsed. This disagreement, classified as HTTP Request Smuggling [CWE-444], allows an attacker to embed a second, hidden request inside a legitimate one.

On routes that invoke serverless plugins, the smuggled request is processed against the response queue used for other in-flight connections. The gateway then returns the attacker-influenced response to a different client sharing the same downstream connection. This breaks isolation between users and enables response queue poisoning, credential theft through mirrored responses, and cache poisoning on downstream proxies.

Root Cause

The root cause is inconsistent handling of HTTP framing headers such as Content-Length and Transfer-Encoding between APISIX and cooperating components on serverless-plugin routes. When the two ends disagree on where one request ends and the next begins, an attacker can desynchronize the connection.

Attack Vector

The attack is remote and unauthenticated. An attacker sends a specially crafted HTTP request to an APISIX endpoint that maps to a route using serverless-pre-function or serverless-post-function. The malformed framing causes APISIX to treat part of the request body as a new request, splicing an attacker response into the shared connection. Subsequent legitimate requests from other clients then receive the smuggled response. Exploitation does not require credentials or user interaction. See the Apache Mailing List Discussion for the vendor's technical description.

Detection Methods for CVE-2026-74848

Indicators of Compromise

HTTP requests containing both Content-Length and Transfer-Encoding: chunked headers targeting APISIX routes.
Unusual response bodies delivered to clients that do not match the request path or method.
Access log entries showing serverless-plugin route paths with unexpected upstream status codes or content lengths.
Client reports of receiving another user's session data or API response on shared connections.

Detection Strategies

Inspect APISIX access.log for requests with conflicting framing headers and abnormally long request lines.
Correlate upstream response sizes with logged request paths to surface response/request mismatches.
Deploy a Web Application Firewall rule that blocks requests carrying both Content-Length and Transfer-Encoding headers.
Run version inventory across API gateway hosts to identify Apache APISIX builds between 2.12.0 and 3.17.0.

Monitoring Recommendations

Forward APISIX and upstream access logs to a centralized analytics platform for correlation across connections.
Alert on spikes in 400-series responses following requests to serverless-plugin routes.
Monitor for repeated requests from a single source containing chunked encoding anomalies.

How to Mitigate CVE-2026-74848

Immediate Actions Required

Upgrade Apache APISIX to version 3.18.0, which contains the vendor fix.
Inventory all routes using serverless-pre-function or serverless-post-function and restrict exposure until patched.
Terminate long-lived HTTP/1.1 keep-alive connections at a trusted front-end proxy that normalizes framing headers.
Audit recent access logs for signs of exploitation attempts against serverless-plugin routes.

Patch Information

Apache released the fix in Apache APISIX 3.18.0. Operators should upgrade directly from any 2.12.0 through 3.17.0 release. Refer to the Apache Mailing List Discussion for the official announcement and upgrade guidance.

Workarounds

Disable serverless-pre-function and serverless-post-function plugins on routes exposed to untrusted networks until the upgrade completes.
Place a compliant reverse proxy in front of APISIX that rejects requests with conflicting Content-Length and Transfer-Encoding headers.
Disable HTTP/1.1 connection reuse for affected routes to limit response queue poisoning windows.

bash

# Configuration example: disable serverless plugins in APISIX config.yaml
plugins:
  # remove or comment out the following entries until patched
  # - serverless-pre-function
  # - serverless-post-function

# Reject conflicting framing headers at the front-end proxy (NGINX example)
# if ($http_transfer_encoding ~* chunked) {
#     if ($http_content_length) { return 400; }
# }