CVE-2023-38522 — Apache Traffic Server: Incomplete field name check allows request smuggling

Description (CNA)

Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Traffic Server	affected 8.0.0 through 8.1.10; affected 9.0.0 through 9.2.4

CWE

CWE-444

References

https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html