Apache Traffic Server vulnerabilities allow DoS, request smuggling

CERT-Bund disclosed multiple security vulnerabilities in Apache Traffic Server, a widely-used HTTP/1.1 compatible caching proxy server. The vulnerabilities carry a CVSS Base Score of 7.5 (high) and allow remote attackers to perform Denial of Service attacks or HTTP Request Smuggling attacks against affected deployments.\n\nOrganizations running Apache Traffic Server on Linux or UNIX systems should immediately audit their deployments, identify affected versions (prior to 9.1.13 or 10.1.2), and apply available patches or mitigations. Unpatched proxy servers could be exploited to disrupt services or manipulate HTTP request handling, potentially affecting downstream systems and users relying on the proxy infrastructure.