BIT-apisix-2026-74848

vendorUSosv

Apache APISIX: Cross-user response poisoning in serverless plugins

view advisory published 2026-09-01Licence: per source

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-74848US	high7.5	0.59% (48th)	—	2026-08-27
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or ot…

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan