CVE-2026-58150

CVE-2026-58150 in Apache Traffic Server exposes a fundamental flaw in how HTTP/2 requests are translated to HTTP/1.1 backends. The vulnerability: ATS accepts the Transfer-Encoding header in HTTP/2 requests, then passes it through during protocol translation. Since HTTP/2 has no semantic use for Transfer-Encoding (the header is an HTTP/1.1 artifact replaced by DATA frames), this creates the exact conditions for HTTP request smuggling—an attacker can prepend a smuggled prefix to the next pipelined request by manipulating how ATS and the backend interpret this header differently. The affected version range—8.x through 10.x—spans three major branches, indicating this is not an isolated code error but a systemic failure in how the HTTP/2 translation layer was designed from inception. When HTTP/2 support was retrofitted onto proxies originally built for HTTP/1.1, the pragmatic path was header passthrough. That architectural decision became debt that survived across major versions because the translation layer was treated as 'finished' rather than an active security surface. Check your deployment: if ATS terminates HTTP/2 connections from clients and forwards to HTTP/1.1 backends, you are in the blast radius. The CVSS 10 rating is technically accurate—unauthenticated, network-accessible, complete impact—but the low EPSS (0.00316) likely reflects the narrow operational pattern required: specifically an HTTP/2-to-HTTP/1.1 translation topology with pipelining enabled. Not every ATS deployment is equally exposed. The fix in 9.2.15 and 10.1.4 determines whether this was understood correctly. If the patch rejects Transfer-Encoding outright at the HTTP/2 boundary, that's a proper protocol contract enforcement. If it sanitizes the header during translation while allowing it through, that suggests the underlying architectural pattern wasn't fixed—just patched for this specific case, leaving similar vulnerabilities latent in related code paths. Operational priority: identify whether your ATS instance routes HTTP/2 clients to HTTP/1.1 backends. If so, treat this as urgent. The attack is structurally simple—no complex exploitation required once tooling emerges—targeting the translation chokepoint rather than a specific server configuration. Monitor for the release of public exploit code; the historical pattern for HTTP smuggling vulnerabilities shows a 12-18 month lag between disclosure and weaponization, but the simplicity of this attack vector may compress that timeline.

Reviewed through automated stages and approved by a human before publication.