CVE-2023-38522 is a high severity (CVSS 7.5) HTTP request smuggling flaw in Apache Traffic Server: it accepts characters not allowed in header field names and forwards malformed requests to origins. It affects 8.0.0 through 8.1.10 and 9.0.0 through 9.2.4. Upgrade to 8.1.11 or 9.2.5.
What's affected
The affected product is Apache Traffic Server. The record and the Apache announcement agree on the versions: 8.0.0 through 8.1.10 and 9.0.0 through 9.2.4. The flaw is that Traffic Server accepts characters that are not allowed in HTTP field names and forwards the malformed request to origin servers. This can be used for request smuggling and may also lead to cache poisoning if the origin servers are vulnerable. The record is dated 2024-07-26 and scores 7.5, High, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
The Apache Traffic Server announcement of 25 July 2024 says 8.x users should upgrade to 8.1.11 or later and 9.x users to 9.2.5 or later. The same announcement covers two further CVEs, CVE-2024-35161 and CVE-2024-35296, so moving to the fixed releases handles all three. The record references a Debian LTS announcement from September 2024 for packaged builds. I could not load it, so check your distribution's tracker for the package version.
Weakness class: CWE-444.
How to check if you're exposed
Read the running version.
traffic_server -V
Or check the package.
dpkg -l | grep -i trafficserver
rpm -qa | grep -i trafficserver
If the version falls in 8.0.0 through 8.1.10 or 9.0.0 through 9.2.4, it is affected. Also list the origin servers behind each Traffic Server and note which of them parse headers differently.
What to do now
- Find every Traffic Server instance, including those inside CDN or proxy tiers you run yourself.
- Upgrade 8.x to 8.1.11 or later, and 9.x to 9.2.5 or later.
- If you use a distribution package, check its security tracker for the backported fix.
- Check your origins and any other proxies for the same header parsing problem.
- After upgrading, review cache contents for odd entries if you suspect earlier abuse.
Why it matters
Request smuggling happens when two HTTP components disagree about where one request ends and the next begins, or about what a header means. Here Traffic Server accepts a header name that the specification forbids and passes it on. An origin that reads that header differently can be tricked into treating part of one request as the start of another.
The harm falls on other users of the same connection, and can include cache poisoning, where a bad response is stored and served to many people. The practical fix is strict parsing at the edge, which the update provides. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the Apache announcement does not report exploitation.
Inconsistent interpretation of HTTP requests, often called request smuggling, happens when two HTTP components disagree about where a request starts and ends or what its headers mean. A proxy accepts a request the origin reads differently, so an attacker can hide a second request inside the first. Strict parsing that rejects malformed headers at the edge closes the gap.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the libraries a project declares, and reachability analysis helps show whether a vulnerable library is actually called. Copies bundled inside other products need your own inventory as well.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which versions fix it?
Apache says 8.1.11 or later for the 8.x line and 9.2.5 or later for the 9.x line.
Does the same upgrade cover the other CVEs in the announcement?
Apache's announcement lists CVE-2024-35161 and CVE-2024-35296 with the same fixed releases.
Sources
Last reviewed: 19 October 2026.
