HTTP/2 Origin Trailers Improperly Forwarded to HTTP/1 Clients

Apache Traffic Server contains a critical vulnerability in its HTTP protocol conversion logic that affects versions 10.0.0 through 10.1.3. When converting HTTP/2 requests to HTTP/1, the server fails to properly apply chunked transfer encoding framing to origin trailers, resulting in malformed HTTP responses sent to downstream HTTP/1 clients. This vulnerability has a CVSS score of 8.3 and falls under CWE-444 (Inconsistent Interpretation of HTTP Requests). Organizations running affected Apache Traffic Server instances—particularly those operating as reverse proxies or content delivery infrastructure—are at risk of request smuggling attacks, cache poisoning, and potential remote code execution if clients misinterpret the malformed responses.

While this CVE currently maps to zero Casky.ai skills due to its protocol-specific nature, practitioners should monitor for attack indicators related to HTTP request smuggling and cache manipulation techniques. Security teams would detect potential exploitation through anomalous HTTP response patterns, including malformed chunked encoding sequences and trailer headers appearing outside proper framing boundaries in network traffic analysis. Immediate remediation is critical: upgrading to Apache Traffic Server 9.2.15 or 10.1.4 eliminates the vulnerability. Teams should prioritize this patch given the severity score and the foundational role proxy servers play in network security posture.