CVE-2024-35296: 
Apache Traffic Server vulnerability analysis and mitigation

Invalid Accept-Encoding header vulnerability in Apache Traffic Server affects versions from 8.0.0 through 8.1.10 and from 9.0.0 through 9.2.4. The vulnerability was discovered and disclosed in July 2024, impacting the caching functionality of the server (NVD CVE).

The vulnerability is classified with a CVSS v3.1 Base Score of 8.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L. The issue is categorized under CWE-20 (Improper Input Validation) and causes the server to fail cache lookup operations and force request forwarding when presented with invalid Accept-Encoding headers (NVD CVE).

When exploited, this vulnerability forces Apache Traffic Server to bypass its cache lookup mechanism and forward requests directly, potentially leading to increased server load and degraded performance. The CVSS scoring indicates high impact on integrity and low impact on availability, with no direct impact on confidentiality (NVD CVE).

The vulnerability has a network attack vector (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N) to exploit, making it relatively straightforward to target (NVD CVE).

Users are strongly recommended to upgrade to Apache Traffic Server version 8.1.11 or 9.2.5, which contain fixes for this vulnerability. These updated versions have been released specifically to address this security issue (NVD CVE).