CVE-2026-74848: Apache APISIX: Cross-user response poisoning in serverless plugins
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX.
An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes.
This issue affects Apache APISIX: from 2.12.0 through 3.17.0.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache APISIXto a version that resolves this vulnerability.Fixed in 3.18.0 - Compensating control
If upgrade to Apache APISIX 3.18.0 is not immediately possible, mitigate the HTTP Request/Response Smuggling issue by restricting or otherwise protecting access to affected serverless-plugin routes until the fix is applied.
Event History
Frequently Asked Questions
Which deployments are affected?
Apache APISIX versions 2.12.0 through 3.17.0 are affected where serverless-plugin routes are in use. The described impact applies to clients receiving responses through those routes.
What does an attacker need to do to exploit this issue?
The issue is an HTTP request/response smuggling vulnerability. An attacker must be able to send crafted HTTP requests targeting serverless-plugin routes to cause response mix-ups affecting other clients.
What should teams do to remediate the issue?
Upgrade Apache APISIX to version 3.18.0, which fixes the vulnerability.