Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.

This issue affects Apache Traffic Serve…

Apache Traffic Server contains a vulnerability where over-long HTTP header names are truncated, leading to header aliasing. This behavior can be exploited to perform request smuggling and bypass security policies. The issue affects multiple major versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Request smuggling vulnerabilities can allow attackers to poison caches, hijack requests, or bypass access controls. The fix is available in versions 9.2.15 and 10.1.4. Users on affected versions are strongly recommended to upgrade immediately. No workarounds are described in the advisory.