CVE-2024-35161: 
Apache Traffic Server vulnerability analysis and mitigation

Apache Traffic Server has been identified with a vulnerability (CVE-2024-35161) where it forwards malformed HTTP chunked trailer sections to origin servers. This vulnerability affects Apache Traffic Server versions from 8.0.0 through 8.1.10 and from 9.0.0 through 9.2.4. The issue was disclosed on July 26, 2024 (NVD).

The vulnerability is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests - HTTP Request/Response Smuggling). It has received a CVSS v3.1 base score of 7.5 (HIGH) from NIST with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, while CISA-ADP assessed it with a higher score of 9.1 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD).

The vulnerability can be exploited for request smuggling attacks and may lead to cache poisoning if the origin servers are vulnerable. This creates potential security risks for systems running affected versions of Apache Traffic Server (NVD).

Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue. As a temporary workaround, users can set a new setting (proxy.config.http.dropchunkedtrailers) to prevent forwarding chunked trailer sections (NVD).