CVE-2026-74848 is an HTTP request and response smuggling flaw (CWE-444) in Apache APISIX. On routes that use the serverless plugins, other clients could receive attacker-chosen or other users' responses. The record rates it High at 7.5. Apache says upgrade to version 3.18.0.
What's affected
Apache says APISIX from 2.12.0 through 3.17.0 is affected, and recommends upgrading to 3.18.0, which fixes the issue. The record repeats the same range and recommendation. The oss-security announcement credits the reporter as Xclow3n (Rajat Raghav).
The issue applies to routes that use serverless plugins. The record rates it 7.5 (High) with network access, low complexity, no privileges, and integrity as the only impact. Apache's own post and the record agree on versions and on the fix, so there is no conflict to flag.
How to check if you're exposed
Find the version of APISIX on each gateway.
apisix version
For containers, check the image tag. Then review your routes with the plugin named in this CVE, since only routes that use it are in the path. You can list routes through the Admin API or in your configuration files.
What to do now
- Upgrade Apache APISIX to 3.18.0.
- List the routes that use serverless plugins, and prioritise those that serve user specific content.
- If you cannot upgrade yet, consider disabling the serverless plugins on routes where they are not essential.
- Check that your front proxy and APISIX agree on how to read request boundaries, and normalise ambiguous requests at the edge.
- Test for response mix ups in staging with two simulated users.
Why it matters
The class is HTTP request smuggling, also called inconsistent interpretation of HTTP requests, CWE-444. It arises when two components in a chain, such as a load balancer and a gateway, disagree about where one request ends and the next begins. The leftover bytes are read as the start of another request, and a later client can receive the response meant for someone else.
Apache's description of the result is "attacker-chosen or other users' responses". Response mix ups can expose private data or serve poisoned content, and they are hard to trace in logs. Using one HTTP implementation consistently, and rejecting ambiguous requests, are the standard defences. KEV status is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect every APISIX route?
The announcement ties it to serverless plugin routes. Review those first.
What is the fixed version?
Apache recommends 3.18.0.
Sources
Last reviewed: 18 October 2026.
