Warning: Multiple vulnerabilities in Apache Traffic Server, Patch Immediately!

The Apache Traffic Server (ATS) is a forwards and reverse proxy server used globally to handle HTTP traffic routing, policy enforcement and more. Because of its role in managing network traffic, vulnerabilities in components like the Apache Traffic Server can have a significant impact on the availability, security, and integrity of the applications and services that rely on it.

The latest patch for ATS fixes 38 vulnerabilities affecting various components and functions. Most of the vulnerabilities are of low complexity, remotely exploitable and require no privileges or user interaction. While no PoC or in the wild exploitation has been reported, the potential impact and ease of exploitation make this an important security notification.

The most severe vulnerabilities from the security bulletin are linked to HTTP header parsing. Sending malicious HTTP requests to a vulnerable server could result in unexpected behavior which could be leveraged by an adversary for malicious purposes. Possible outcomes of such an exploit include HTTP request smuggling, resource exhaustion, policy bypass and more. It could also be possible to chain the vulnerabilities, increasing the impact on the target.

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority, after thorough testing.

Apache security bulletin recommends: 9.x users upgrade to 9.2.15 or later versions 10.x users should upgrade to 10.1.4 or later versions

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity, ensuring a swift response in case of an intrusion.

In case of an intrusion, you can report an incident via: .

While patching appliances or software to the newest version may provide safety from future exploitation, it does not remediate historic compromise.