Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling.

This issue affects Apache Traffic Server: fro…

A vulnerability in Apache Traffic Server allows HTTP request smuggling via improper handling of Transfer-Encoding headers in HTTP/2 requests. The server fails to reject Transfer-Encoding in HTTP/2 requests, enabling downgrade request smuggling attacks. Affected versions span three major release branches: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. This type of vulnerability can allow attackers to bypass security controls, poison caches, or hijack requests. Users are strongly recommended to upgrade to the patched versions 9.2.15 or 10.1.4. The issue has been assigned CVE-2026-58150 and is tracked by NVD.