Search for vulnerabilities
Vulnerability details: VCID-6mqf-nqvk-yyhn
Vulnerability ID VCID-6mqf-nqvk-yyhn
Aliases CVE-2024-35161
Summary Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked trailer section. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 8.2
Risk 4.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-35161.json
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
epss 0.00537 https://api.first.org/data/v1/epss?cve=CVE-2024-35161
cvssv3.1 9.1 https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
ssvc Track https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-35161
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-35161.json
https://api.first.org/data/v1/epss?cve=CVE-2024-35161
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35161
1077141 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1077141
2300035 https://bugzilla.redhat.com/show_bug.cgi?id=2300035
c4mcmpblgl8kkmyt56t23543gp8v56m0 https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
CVE-2024-35161 https://nvd.nist.gov/vuln/detail/CVE-2024-35161
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-35161.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-31T17:38:35Z/ Found at https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-35161
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.66507
EPSS Score 0.00537
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:01:53.936596+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/35xxx/CVE-2024-35161.json 37.0.0