Vulnerability-Lookup

WID-SEC-W-2026-0978

Vulnerability from csaf_certbund - Published: 2026-04-06 22:00 - Updated: 2026-04-06 22:00

Summary

Apache Traffic Server: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Apache Traffic Server ist ein skalier- und erweiterbarer, mit HTTP/1.1 kompatibler "caching proxy server".

Angriff: Ein entfernter Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um einen Denial of Service- oder Request-Smuggling-Angriff durchzuführen.

Betroffene Betriebssysteme: - Linux - UNIX

CVE-2025-58136

Affected products

Known affected 4 products

Product	Identifier	Version
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Apache Traffic Server <9.1.13 Apache / Traffic Server		<9.1.13
Apache Traffic Server <10.1.2 Apache / Traffic Server		<10.1.2

CVE-2025-65114

Affected products

Known affected 4 products

Product	Identifier	Version
Debian Linux Debian	`cpe:/o:debian:debian_linux:-`	—
Fedora Linux Fedora	`cpe:/o:fedoraproject:fedora:-`	—
Apache Traffic Server <9.1.13 Apache / Traffic Server		<9.1.13
Apache Traffic Server <10.1.2 Apache / Traffic Server		<10.1.2

References

9 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://seclists.org/oss-sec/2026/q2/10	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
https://lists.debian.org/debian-security-announce…	external
https://bodhi.fedoraproject.org/updates/FEDORA-EP…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Apache Traffic Server ist ein skalier- und erweiterbarer, mit HTTP/1.1 kompatibler \"caching proxy server\".",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um einen Denial of Service- oder Request-Smuggling-Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0978 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0978.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0978 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0978"
      },
      {
        "category": "external",
        "summary": "Mailing List OSS Security vom 2026-04-02",
        "url": "https://seclists.org/oss-sec/2026/q2/10"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-7839A46D9D vom 2026-04-02",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-7839a46d9d"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-7D17B6D554 vom 2026-04-02",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-7d17b6d554"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-A157BD84C4 vom 2026-04-02",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-a157bd84c4"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-7B719A7A58 vom 2026-04-02",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-7b719a7a58"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-6199 vom 2026-04-05",
        "url": "https://lists.debian.org/debian-security-announce/2026/msg00108.html"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-EPEL-2026-EC5DF302A7 vom 2026-04-02",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-ec5df302a7"
      }
    ],
    "source_lang": "en-US",
    "title": "Apache Traffic Server: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-04-06T22:00:00.000+00:00",
      "generator": {
        "date": "2026-04-07T11:24:37.109+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0978",
      "initial_release_date": "2026-04-06T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-04-06T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.1.13",
                "product": {
                  "name": "Apache Traffic Server \u003c9.1.13",
                  "product_id": "T052430"
                }
              },
              {
                "category": "product_version",
                "name": "9.1.13",
                "product": {
                  "name": "Apache Traffic Server 9.1.13",
                  "product_id": "T052430-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:traffic_server:9.1.13"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.1.2",
                "product": {
                  "name": "Apache Traffic Server \u003c10.1.2",
                  "product_id": "T052431"
                }
              },
              {
                "category": "product_version",
                "name": "10.1.2",
                "product": {
                  "name": "Apache Traffic Server 10.1.2",
                  "product_id": "T052431-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:traffic_server:10.1.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Traffic Server"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-58136",
      "product_status": {
        "known_affected": [
          "2951",
          "74185",
          "T052430",
          "T052431"
        ]
      },
      "release_date": "2026-04-06T22:00:00.000+00:00",
      "title": "CVE-2025-58136"
    },
    {
      "cve": "CVE-2025-65114",
      "product_status": {
        "known_affected": [
          "2951",
          "74185",
          "T052430",
          "T052431"
        ]
      },
      "release_date": "2026-04-06T22:00:00.000+00:00",
      "title": "CVE-2025-65114"
    }
  ]
}

CVE-2025-58136 (GCVE-0-2025-58136)

Vulnerability from cvelistv5 – Published: 2026-04-02 15:54 – Updated: 2026-04-02 18:13

Title

Apache Traffic Server: A simple legitimate POST request causes a crash

Summary

A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-670 - Always-Incorrect Control Flow Implementation

Assigner

apache

References

1 reference

URL	Tags
https://lists.apache.org/thread/2s11roxlv1j8ph6q5…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Traffic Server	Affected: 10.0.0 , ≤ 10.1.1 (semver) Affected: 9.0.0 , ≤ 9.2.12 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-58136",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-02T18:12:52.546152Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-02T18:13:21.125Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Traffic Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "10.1.1",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.2.12",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA bug in POST request handling causes a crash under a certain condition.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue.\u003c/p\u003eA workaround for older versions is to set\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eproxy.config.http.request_buffer_enabled to 0 (the default value is 0).\u0026nbsp;\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A bug in POST request handling causes a crash under a certain condition.\n\nThis issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12.\n\nUsers are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue.\n\nA workaround for older versions is to set\u00a0proxy.config.http.request_buffer_enabled to 0 (the default value is 0)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670 Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T15:54:47.013Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Traffic Server: A simple legitimate POST request causes a crash",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-58136",
    "datePublished": "2026-04-02T15:54:47.013Z",
    "dateReserved": "2025-08-25T21:36:46.557Z",
    "dateUpdated": "2026-04-02T18:13:21.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-65114 (GCVE-0-2025-65114)

Vulnerability from cvelistv5 – Published: 2026-04-02 15:55 – Updated: 2026-04-02 18:10

Title

Apache Traffic Server: Malformed chunked message body allows request smuggling

Summary

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1. Users are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

apache

References

1 reference

URL	Tags
https://lists.apache.org/thread/2s11roxlv1j8ph6q5…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Traffic Server	Affected: 9.0.0 , ≤ 9.2.12 (semver) Affected: 10.0.0 , ≤ 10.1.1 (semver)

Credits

Katsutoshi Ikenoya

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-65114",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-02T18:09:43.044758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-02T18:10:10.171Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Traffic Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "9.2.12",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "10.1.1",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Katsutoshi Ikenoya"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eApache Traffic Server allows request smuggling if c\u003c/span\u003ehunked messages are malformed.\u003c/span\u003e\u0026nbsp;\u003c/p\u003e\u003cp\u003eThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue.\u003c/p\u003e"
            }
          ],
          "value": "Apache Traffic Server allows request smuggling if chunked messages are malformed.\u00a0\n\nThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1.\n\nUsers are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-02T15:55:27.280Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Traffic Server: Malformed chunked message body allows request smuggling",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-65114",
    "datePublished": "2026-04-02T15:55:27.280Z",
    "dateReserved": "2025-11-18T00:11:27.195Z",
    "dateUpdated": "2026-04-02T18:10:10.171Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-0978

CVE-2025-58136 (GCVE-0-2025-58136)

CVE-2025-65114 (GCVE-0-2025-65114)

Tags

Sightings

Nomenclature