CVE-2024-35296

CVE-2024-35296: Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests

Vendor Apache Software Foundation
Product Apache Traffic Server
Weakness CWE-20 · Input validation
Published July 26, 2024
Last update November 3, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

Description

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.

Key dates

Disclosure timeline

July 26, 2024 CVE published
November 3, 2025 Record updated