---
title: "Critical Apache Traffic Server Bugs Allow Remote DoS Attacks"
date: 2026-04-06
author: "Sofia Ramirez"
featured_image: "https://sqmagazine.co.uk/wp-content/uploads/2026/04/critical-apache-traffic-server-bugs-discovered.jpg"
categories:
  - name: "Cybersecurity"
    url: "/cybersecurity.md"
tags:
  - name: "News"
    url: "/tag/news.md"
---

# Critical Apache Traffic Server Bugs Allow Remote DoS Attacks

Newly disclosed vulnerabilities in Apache Traffic Server could let attackers crash servers or manipulate web traffic without authentication.

## Quick Summary – TLDR:

- Two high severity vulnerabilities found in Apache Traffic Server.
- Unauthenticated attackers can crash servers using simple POST requests.
- Second flaw enables HTTP request smuggling, risking data exposure.
- Immediate upgrades required as only partial workaround exists.

## What Happened?

The Apache Software Foundation released security updates on April 2, 2026, addressing two critical flaws in **Apache Traffic Server**, a widely used enterprise proxy and caching system. The issues were discovered by security researchers **Masakazu Kitajo** and **Katsutoshi Ikenoya**, and both vulnerabilities stem from improper handling of HTTP request body data.

> ⚠️ \*\*Vulnerability Alert:\*\* Apache Traffic Server — Two high-severity DoS/request-smuggling vulnerabilities (CVE-2025-58136, CVE-2025-65114)  
> 📅 \*\*Timeline:\*\* Disclosure: 2026-04-02, Patch: 2026-04-02  
>   
> 🆔 \*\*CVE-2025-58136\*\* | 📊 CVSS: 7.5 (HIGH 🟠) | 📈 EPSS: 12.25%  
> 🆔…
> 
> — Syed Aquib (@syedaquib77) [April 6, 2026](https://twitter.com/syedaquib77/status/2041125706948653099?ref_src=twsrc%5Etfw)

 ## Details of the Vulnerabilities

The first vulnerability, tracked as **CVE-2025-58136**, exposes a serious flaw in how the server processes **POST requests**. Under specific conditions, sending a crafted request can force the server into an unrecoverable state, leading to a complete crash.

What makes this issue particularly dangerous is how easy it is to exploit:

- **No authentication required**
- **No user interaction needed**
- **Low effort, high impact attack vector**

This means any exposed server could be taken offline almost instantly, posing a direct threat to **enterprise uptime and service availability**.

## HTTP Request Smuggling Threat

The second vulnerability, identified as **CVE-2025-65114**, involves improper parsing of **chunked HTTP message bodies**. This leads to inconsistencies in how requests are interpreted between the proxy and backend servers.

This flaw enables **HTTP request smuggling**, a sophisticated attack technique that can:

- **Bypass security controls**.
- **Poison web caches**.
- **Intercept sensitive data from other users**.
- **Enable request and response manipulation**.

Because this vulnerability affects how traffic is processed internally, it can be particularly difficult to detect once exploited.

## Affected Versions and Risk Scope

The vulnerabilities impact multiple versions of Apache Traffic Server, including:

- **9.x branch from 9.0.0 to 9.2.12 or 9.2.13 depending on deployment**.
- **10.x branch from 10.0.0 to 10.1.1**.

Given that Apache Traffic Server is widely used in **high traffic enterprise environments**, the potential impact is significant, especially for systems exposed to untrusted networks.

## Fixes and Mitigation Steps

Administrators are strongly advised to upgrade immediately:

- **ATS 9.x users** should update to version **9.1.13 or 9.2.13 or later**
- **ATS 10.x users** should upgrade to **10.1.2 or newer**

These versions fully address both vulnerabilities.

## Temporary Workaround Available

For the **DoS vulnerability (CVE-2025-58136)**, there is a partial mitigation:

- Set **proxy.config.http.request\_buffer\_enabled to 0**

This disables the vulnerable code path and prevents server crashes. Notably, this setting is already enabled by default in many deployments.

However, there is **no workaround** for the request smuggling issue. This makes upgrading critical for full protection.

## Why This Matters for Enterprises?

Apache Traffic Server plays a central role in **managing and caching web traffic** for large scale applications. A flaw that allows attackers to both crash servers and silently manipulate requests creates a **compounded security risk**.

Even though there are **no known active exploits reported yet**, the simplicity of the DoS attack combined with the stealth of request smuggling makes this a high priority issue for security teams.

## SQ Magazine’s Takeaway

I think this is one of those vulnerabilities that looks simple on the surface but carries serious consequences if ignored. A single request crashing a server is already bad, but pairing that with request smuggling makes it much more dangerous. If you are running Apache Traffic Server and delaying updates, you are basically leaving the door open. This is not something to postpone.