Apache Traffic Server contains a vulnerability classified as CWE-444 (Inconsistent Interpretation of HTTP Requests), commonly known as HTTP request/response smuggling. This occurs when the server improperly handles malformed chunked HTTP messages, allowing an attacker to smuggle HTTP requests. The vulnerability affects versions from 9.0.0 through 9.2.12 and 10.0.0 through 10.1.1. The vendor has addressed this issue in versions 9.2.13 and 10.1.2, which correct the parsing logic to prevent request smuggling.

Successful exploitation of this vulnerability can allow an attacker to bypass security controls by injecting or manipulating HTTP requests, potentially leading to unauthorized actions or access. The CVSS score of 7.5 (high) reflects the network attack vector, low complexity, no privileges required, and no user interaction needed. The impact is limited to integrity compromise without direct confidentiality or availability impact.

Users should upgrade Apache Traffic Server to version 9.2.13 or 10.1.2 or later, where this vulnerability is fixed. No other mitigations are specified or required once the upgrade is applied. Patch status is confirmed by the vendor advisory recommending these versions.