CVE-2026-58155 | BDVDB-2026-353532 Detail
ApacheApache Traffic Server
Description#
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-444 Inconsistent Interpretation of HTTP Requests
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.