CVE-2024-35161 Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling
Attackers can exploit incomplete chunked trailer checks to perform request smuggling and cache poisoning in Apache Traffic Server deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-35161?
CVE-2024-35161 is a critical vulnerability in Apache Traffic Server, published on 26 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.
Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked trailer section. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
Weakness: CWE-444
Which versions are affected by CVE-2024-35161?
It affects 1 product.
Products include Apache Traffic Server.
How do I fix CVE-2024-35161?
Upgrade to a fixed version.
Is CVE-2024-35161 being exploited?
There is no known exploitation of CVE-2024-35161 in the wild and no public exploit code.
Other vulnerabilities in Apache Traffic Server
Sources
Also known as DEBIAN-CVE-2024-35161, GHSA-j49j-p46f-pfcv, UBUNTU-CVE-2024-35161.