Summary
CVE-2026-58153 is an HTTP response smuggling vulnerability (CWE-444) in Apache Traffic Server (ATS), affecting versions 10.0.0 through 10.1.3. During HTTP/2-to-HTTP/1 protocol conversion, ATS incorrectly forwards HTTP/2 origin trailers to downstream HTTP/1 clients without applying proper chunked transfer-encoding framing. The vulnerability carries a CVSS v3.1 score of 8.3 (High) and is exploitable remotely without authentication or user interaction. The IONIX research team is tracking this vulnerability and recommends immediate patching for all exposed ATS instances.
Technical details
- Root cause: CWE-444 — Inconsistent Interpretation of HTTP Requests (‘HTTP Request/Response Smuggling’). ATS fails to correctly reframe HTTP/2 trailers into valid chunked-encoding boundaries when performing HTTP/2-to-HTTP/1 protocol downconversion, causing downstream HTTP/1 clients to receive malformed or ambiguous response framing.
- Trigger conditions: An attacker sends HTTP/2 requests containing origin trailers through an ATS reverse proxy or caching proxy; the unframed trailers are propagated to HTTP/1 clients behind the proxy, enabling response interpretation discrepancies.
- Attack vector: Network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N).
- Impact: Scope:Changed (S:C) — the impact extends beyond the ATS process itself to downstream clients and cached content. Partial confidentiality, integrity, and availability impact (C:L/I:L/A:L), consistent with response smuggling or cache poisoning enabling content injection, session hijacking, or cache corruption against clients served by the affected proxy.
Affected software
- Apache Traffic Server 10.0.0 through 10.1.3
Severity
- CVSS v3.1 Base Score: 8.3 (High)
- Vector string:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Mitigation and recommended actions
- Immediate — patch: Upgrade to Apache Traffic Server 9.2.15 or 10.1.4, as recommended by the Apache Software Foundation in their security advisory.
- If immediate patching is not feasible, consider restricting network access to ATS instances and monitoring for anomalous HTTP/2 traffic containing unusual trailer fields as a temporary defensive measure.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

