CVE-2026-58153 in Traffic Server
Summary
by MITRE • 07/29/2026
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in Apache Traffic Server represents a critical protocol handling flaw that occurs during HTTP/2 to HTTP/1 content conversion processes. This issue manifests when the proxy server forwards HTTP/2 origin trailers to HTTP/1 clients without implementing proper chunked transfer encoding mechanisms. The flaw stems from inadequate protocol translation between different HTTP versions, specifically failing to maintain the correct framing semantics required for HTTP/1 compatibility.
The technical implementation of this vulnerability involves the improper handling of trailer headers that are part of HTTP/2's streaming protocol. When Apache Traffic Server receives HTTP/2 responses containing trailer headers, it attempts to forward these trailers to HTTP/1 clients but fails to properly encode them within chunked transfer encoding boundaries. This creates malformed HTTP responses that can cause client applications to misinterpret the content stream and potentially crash or behave unpredictably when processing the response data.
From an operational perspective, this vulnerability presents significant security implications as it can lead to denial of service conditions where HTTP/1 clients fail to properly parse the malformed responses. The issue affects all versions from 10.0.0 through 10.1.3, representing a substantial attack surface for adversaries who might exploit this behavior to disrupt services or potentially escalate privileges through malformed response handling. The vulnerability aligns with CWE-119, which addresses improper restriction of operations within a limited access scope, and can be categorized under ATT&CK technique T1210 for exploitation of remote services.
The impact extends beyond simple service disruption as this flaw can enable attackers to craft specific HTTP/2 responses that when translated through the vulnerable proxy will cause HTTP/1 clients to process malformed data streams. This creates potential for information disclosure, application crashes, and in some scenarios could provide a pathway for more sophisticated attacks if client applications do not properly validate response boundaries. The issue specifically affects the HTTP/2 to HTTP/1 conversion path where trailer headers are not properly handled during protocol translation.
Organizations utilizing Apache Traffic Server within their infrastructure should immediately implement the recommended upgrades to version 9.2.15 or 10.1.4 to address this vulnerability. These patched versions contain proper handling of trailer headers during protocol conversion, ensuring that HTTP/2 trailers are correctly formatted for HTTP/1 clients through appropriate chunked transfer encoding. The remediation addresses the fundamental flaw in the proxy server's HTTP protocol handling and restores proper interoperability between different HTTP versions while maintaining security posture against potential exploitation attempts.