Description
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Remediation
References
Related Vulnerabilities
Plone CMS Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-4196)
PHP Other Vulnerability (CVE-2005-3319)
MySQL CVE-2018-2665 Vulnerability (CVE-2018-2665)
WordPress Plugin Elements For Elementor Local File Inclusion (2.1)
Apache HTTP Server NULL Pointer Dereference Vulnerability (CVE-2021-41524)