CVE-2023-38522 Apache Traffic Server: Incomplete field name check allows request smuggling
Attackers can smuggle requests or poison caches by exploiting incomplete HTTP field name validation in Apache Traffic Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38522?
CVE-2023-38522 is a high-severity vulnerability in Apache Traffic Server, published on 26 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.
Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
Weakness: CWE-444
Which versions are affected by CVE-2023-38522?
It affects 1 product.
Products include Apache Traffic Server.
How do I fix CVE-2023-38522?
Upgrade to a fixed version.
Is CVE-2023-38522 being exploited?
There is no known exploitation of CVE-2023-38522 in the wild and no public exploit code.
Other vulnerabilities in Apache Traffic Server
Sources
Also known as DEBIAN-CVE-2023-38522, GHSA-68qf-xhq3-9qj5, UBUNTU-CVE-2023-38522.