Apache · Apache Traffic Server · CVE-2024-35296
**Name of the Vulnerable Software and Affected Versions**
Apache Traffic Server versions 8.0.0 through 8.1.10
Apache Traffic Server versions 9.0.0 through 9.2.4
**Description**
The issue is related to insufficient input validation, allowing a remote attacker to execute arbitrary requests using the HTTP Accept-Encoding header. An invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests.
**Recommendations**
For Apache Traffic Server versions 8.0.0 through 8.1.10, upgrade to version 8.1.11.
For Apache Traffic Server versions 9.0.0 through 9.2.4, upgrade to version 9.2.5.
As a temporary workaround, consider restricting the use of the Accept-Encoding header in HTTP requests to minimize the risk of exploitation.