Apache Traffic Server Internal @Header Metadata Spoofing (CVE-2026-33267)

CVE-2026-33267 is an internal metadata spoofing vulnerability in Apache Traffic Server. ATS uses @-prefixed headers (e.g., @Ats-Internal, @ICAP-Status, @TCPInfo) as internal metadata that lives in the in-memory header structure but is never serialized on the wire. In vulnerable versions, @ headers supplied by the client request and origin response are not stripped before plugin hooks run (TS_HTTP_READ_REQUEST_HDR_HOOK, TS_HTTP_READ_RESPONSE_HDR_HOOK, remap plugins). An attacker can spoof ATS internal metadata, causing plugins (cache, ACL, header_rewrite) to trust attacker-controlled internal state.

The PoC sends HTTP requests with @-prefixed headers via raw sockets (curl silently drops @ headers) to demonstrate that vulnerable ATS instances pass them through to plugins.

Root Cause

Apache Traffic Server does not strip @-prefixed headers from incoming client requests or origin responses before invoking plugin hooks. These headers are intended as internal-only metadata that plugins trust for cache control, ACL decisions, and routing.

Attack Flow

1. Craft request: Build HTTP request with @-prefixed headers (e.g., @Ats-Internal: pwned)
2. Raw socket delivery: Send via raw TCP socket (required because curl strips @ headers)
3. Plugin impact: ATS plugins see attacker-controlled internal metadata, potentially bypassing ACLs, poisoning cache entries, or manipulating routing decisions