CVE 追蹤：攻擊手法（smuggling、cache poisoning、HTTP/2 DoS、WAF bypass）

[HIGH 7.5] CVE-2026-115482 — Amplification

Thu, 22 Oct 2026 19:17:48 +0000

In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This is related to header_out_dynamic_entry and es_max_header_list_size.

CVSS 3.1：7.5 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE：CWE-770
比對：Amplification（關鍵字 amplification attack|reflection attack）
NVD 狀態：Deferred｜發布 2026-10-22｜最後修改 2026-10-22T19:17

參考連結：

[CRITICAL 9.3] CVE-2026-111816 — Apache Traffic Server, Cache poisoning

Thu, 22 Oct 2026 16:56:52 +0000

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

CVSS 3.1：9.3 CRITICAL（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
CWE：CWE-444
比對：Apache Traffic Server（關鍵字 Apache Traffic Server）；Cache poisoning（關鍵字 cache poisoning）
NVD 狀態：Awaiting Analysis｜發布 2026-10-21｜最後修改 2026-10-22T16:56

參考連結：

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc

[CRITICAL 9.3] CVE-2026-111809 — Apache Traffic Server, Request smuggling

Thu, 22 Oct 2026 16:56:52 +0000

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

CVSS 3.1：9.3 CRITICAL（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
CWE：CWE-444
比對：Apache Traffic Server（關鍵字 Apache Traffic Server）；Request smuggling（關鍵字 request smuggling）
NVD 狀態：Awaiting Analysis｜發布 2026-10-21｜最後修改 2026-10-22T16:56

參考連結：

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc

[CRITICAL 9.1] CVE-2026-109829 — Cache poisoning

Mon, 19 Oct 2026 20:45:43 +0000

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handler changes the origin, so a response produced after a cross-origin redirect is stored under the original key. An attacker who controls the target of a redirect from a trusted URL can have their response cached under that trusted URL and served to later callers, allowing persistent cache poisoning, and the same key confusion lets a private, non-stored redirect response to a user-specific resource be stored under the original URL and served to a later unauthenticated caller, disclosing private data. Applications are affected only when an originless Agent, a shared cache store, and the redirect-then-cache composition are all used. The issue is fixed in undici 7.30.1 and 8.12.2, which verify the producing origin still matches the cache key and preserve each redirect hop's cache-control policy before storing, and users should upgrade to one of those versions or later. As a workaround, compose the cache interceptor before the redirect interceptor, use per-origin dispatchers and cache stores, or disable shared caching on redirect-capable requests.

CVSS 3.1：9.1 CRITICAL（NVD）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE：CWE-346, CWE-524
比對：Cache poisoning（關鍵字 cache poisoning）
NVD 狀態：Analyzed｜發布 2026-10-15｜最後修改 2026-10-19T20:45

參考連結：

[HIGH 7.2] CVE-2026-41510 — Coraza, WAF bypass

Fri, 16 Oct 2026 16:00:33 +0000

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGS_POST without enforcing the cap. The flaw is triggered when an unauthenticated attacker sends more arguments than SecArgumentsLimit or supplies bodies that expand beyond the configured argument and flattening budgets. An unauthenticated attacker can flood requests with arguments so excess values are silently omitted from ARGS, ARGS_GET, ARGS_NAMES, ARGS_GET_NAMES, ARGS_POST, or ARGS_PATH before security rules inspect them; affected urlencoded and JSON processing can also consume excessive memory. The omission can bypass WAF rules protecting the downstream application, and unbounded or amplified argument processing can cause memory consumption and service degradation. This issue is fixed in version 3.8.1.

CVSS 3.1：7.2 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
CWE：CWE-693, CWE-770
比對：Coraza（關鍵字 \bCoraza\b）；WAF bypass（關鍵字 \bWAF bypass\b|bypass (the )?(web application firewall|WAF)）
NVD 狀態：Awaiting Analysis｜發布 2026-10-12｜最後修改 2026-10-16T16:00

參考連結：

[HIGH 7.7] CVE-2026-61642 — Squid, Request smuggling

Fri, 16 Oct 2026 16:00:33 +0000

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.

CVSS 3.1：7.7 HIGH（CNA）
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
CWE：CWE-444
比對：Squid（關鍵字 ^\s*Squid is）；Request smuggling（關鍵字 request smuggling）
NVD 狀態：Awaiting Analysis｜發布 2026-10-13｜最後修改 2026-10-16T16:00

參考連結：