PT-2024-24735 · Apache · Apache Apisix

Brandon Arp + 1 · Published 2024-05-02 · Updated 2025-07-10 · CVE-2024-32638

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.8.0 through 3.9.0

Description The issue is related to an Inconsistent Interpretation of HTTP Requests, also known as 'HTTP Request Smuggling', in Apache APISIX when using the forward-auth plugin.

Recommendations For Apache APISIX versions 3.8.0, upgrade to version 3.8.1 or higher. For Apache APISIX version 3.9.0, upgrade to version 3.9.1 or higher.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BIT-APISIX-2024-32638

CVE-2024-32638

Affected Products

Apache Apisix

References · 10

• https://osv.dev/vulnerability/BIT-apisix-2024-32638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32638 · Security Note
• https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotov · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32638 · Vendor Advisory
• https://t.me/cvenotify/78838 · Telegram Post
• https://t.me/cvenotify/128369 · Telegram Post
• http://openwall.com/lists/oss-security/2024/05/02/2 · Note
• https://twitter.com/VulmonFeeds/status/1786013394488717741 · Twitter Post
• https://twitter.com/oss_security/status/1786053474917986535 · Twitter Post
• https://twitter.com/CVEnew/status/1786000844720386356 · Twitter Post