Unrated severityNVD Advisory· Published May 2, 2024· Updated Feb 13, 2025

Apache APISIX: Forward-Auth Request Smuggling

CVE-2024-32638

Description

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using forward-auth plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0.

Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Apisixllm-fuzzy
Range: >=3.8.0, <=3.9.0
osv-coords
pkg:bitnami/apisix
Range: >= 3.8.0, < 3.9.1
Apache/Apachecpe-rescue
Range: 3.8.0

Patches

Vulnerability mechanics

References

lists.apache.org/thread/ngvgxllw4zn4hgngkqw2o225kf9wotovmitrevendor-advisory
www.openwall.com/lists/oss-security/2024/05/02/2mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000