A critical request smuggling vulnerability in Apache Traffic Server allows unauthenticated attackers to exploit HTTP/2 to HTTP/1.1 downgrade processes to bypass security filters.

This is an inconsistent interpretation of HTTP requests (CWE-444) vulnerability triggered by the improper handling of Transfer-Encoding headers. The attack is executable by an unauthenticated remote user.

This vulnerability allows attackers to perform request smuggling, which may result in the bypass of security restrictions, unauthorized access, or the manipulation of downstream server requests. With a CVSS score of 10.0, the risk of data compromise and system instability is severe.

Immediate Action: Update Apache Traffic Server to version 9.2.15 or 10.1.4 to ensure proper validation of HTTP/2 request headers.

Proactive Monitoring: Review web server traffic logs for evidence of HTTP/2 to HTTP/1.1 downgrade anomalies or suspicious header manipulation.

Compensating Controls: Utilize a WAF to enforce strict HTTP/2 protocol adherence and block requests containing prohibited Transfer-Encoding headers.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability necessitates immediate patching. Organizations should treat this as a high-priority maintenance item and upgrade to the recommended versions to prevent potential request smuggling attacks.