CVE-2024-35296: Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-26 · updated 2026-06-17
Weakness: CWE-20

Description

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.

Affected products

Apache Software Foundation Apache Traffic Server: from 8.0.0 before 8.1.11; from 9.0.0 before 9.2.5 — fixed in 8.1.11, 9.2.5

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Traffic Server 8.1.11, 9.2.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-35296 or the next vulnerability affects your stack