PT-2025-14566 · Apache+1 · Apache Traffic Server+1

Published 2025-04-02 · Updated 2025-11-24 · CVE-2024-53868

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Traffic Server and Affected Versions Apache Traffic Server versions 9.2.0 through 9.2.9 Apache Traffic Server versions 10.0.0 through 10.0.4

Description Apache Traffic Server is susceptible to HTTP request smuggling when processing malformed chunked messages. This issue can allow an attacker to send a hidden HTTP request, potentially leading to cache poisoning and security bypasses. The vulnerability exists due to improper handling of HTTP request headers. There is no information available regarding the number of potentially affected devices or any real-world incidents where this issue has been exploited.

Recommendations Upgrade to version 9.2.10 or 10.0.5 to resolve the issue.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2025-03879

CVE-2024-53868

DSA-5948-1

OESA-2025-1415

OESA-2025-1416

Affected Products

Apache Traffic Server

Debian

References · 33

• https://osv.dev/vulnerability/OESA-2025-1415 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-53868 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-53868 · Security Note
• https://bdu.fstec.ru/vul/2025-03879 · Security Note
• https://lists.apache.org/thread/rwyx91rsrnmpjbm04footfjjf6m9d1c9 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53868 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53868 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53868 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1416 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-53868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53868 · Security Note
• https://osv.dev/vulnerability/DSA-5948-1 · Vendor Advisory
• https://github.com/apache/trafficserver/commit/3d2f29c88f9b073cb0fd3b9c7f85430e2170acbb · Note
• https://github.com/apache/trafficserver/commit/f266206adb95951436a21850cef2ad8e9e4a28cf · Note
• https://twitter.com/DigitalWarCorp/status/1935637500648939711 · Twitter Post