CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-32638: Apache APISIX: Forward-Auth Request Smuggling
Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0.
Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.
Classification
CVE ID: CVE-2024-32638
Affected Products
Vendor: Apache Software Foundation
Product: Apache APISIX
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.98% (scored less or equal to compared to others)
EPSS Date: 2025-03-14 (when was this score calculated)
References
https://lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotovhttp://www.openwall.com/lists/oss-security/2024/05/02/2