CVE-2019-17565 in Traffic Server
Summary
by MITRE
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/30/2025
Apache Traffic Server suffers from a critical vulnerability in its handling of HTTP chunked encoding that enables attackers to perform HTTP request smuggling attacks. This flaw exists in versions 6.0.0 through 6.2.3, 7.0.0 through 7.1.8, and 8.0.0 through 8.0.5, where the proxy server fails to properly validate and process chunked transfer encoding headers. The vulnerability stems from insufficient input validation and improper handling of malformed chunked encoding sequences that can cause the proxy to incorrectly parse HTTP requests. When an attacker crafts malicious HTTP requests with specially crafted chunked encoding data, the proxy server may process these requests in a manner that allows the attacker to inject additional requests or manipulate the request flow between the client and origin server. This represents a CWE-129 weakness related to improper validation of input boundaries and can be classified under ATT&CK technique T1190 for Proxying, which involves using intermediary systems to route traffic. The impact of this vulnerability extends beyond simple data manipulation as it can enable more sophisticated attacks including cache poisoning, session hijacking, and unauthorized access to protected resources. Attackers can exploit this vulnerability to bypass security controls, manipulate request routing, and potentially gain access to sensitive information that should be protected by the proxy server's security mechanisms. The vulnerability specifically affects the HTTP protocol handling layer of the traffic server, where chunked encoding is processed during request and response handling. When the server receives HTTP requests with malformed chunked encoding, it may interpret the data incorrectly, leading to inconsistent processing of subsequent requests in the connection. This behavior creates opportunities for attackers to inject malicious content or manipulate the flow of legitimate requests through the proxy infrastructure. The vulnerability is particularly dangerous because it can be exploited without requiring authentication or special privileges, making it an attractive target for automated exploitation tools. The recommended remediation involves upgrading to Apache Traffic Server versions 7.1.9 and 8.0.6 or later, which contain patches that properly validate chunked encoding data and prevent the smuggling attacks. Organizations should also implement network monitoring to detect anomalous HTTP traffic patterns that may indicate exploitation attempts, and consider implementing additional security controls such as web application firewalls to provide defense in depth. The vulnerability demonstrates the critical importance of proper HTTP protocol implementation and validation in proxy servers, as these systems serve as gateways for network traffic and must handle malformed inputs gracefully without compromising security. This flaw highlights the need for comprehensive testing of HTTP protocol handling in web infrastructure components, particularly those that process user-supplied data through proxy mechanisms. Organizations running affected versions should urgently apply the patches and conduct thorough security assessments of their proxy server configurations to ensure proper mitigation of this vulnerability.