Do Son 
TL;DR
The Apache Software Foundation fixed 38 Apache Traffic Server vulnerabilities. The patches landed in versions 9.2.15 and 10.1.4. The flaws range from request smuggling and access-control bypass to memory-safety crashes. Apache rates none as critical, though several score 9.2 CVSS. No in-the-wild exploitation has been confirmed.
- Total: 38 CVEs
- Severity: 9 Critical · 23 High · 6 Medium
- Actively exploited: None confirmed
- Highest severity: 10.0 (Critical · CVSSv3) — CVE-2026-33267
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-33267 | 10 | Untrusted @ headers can spoof ATS internal metadata | — | Not exploited |
| CVE-2026-58150 | 10 | HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling | — | Not exploited |
| CVE-2026-57834 | 10 | Malformed chunked message body allows request smuggling | — | Not exploited |
| CVE-2026-58162 | 10 | Certifier plugin trusts client SNI when generating certificates | — | Not exploited |
| CVE-2026-58155 | 9.3 | Header-name length truncation enables header aliasing and request smuggling | — | Not exploited |
| CVE-2026-41920 | 9.3 | SNI to Host header matching policy is not properly enforced | — | Not exploited |
| CVE-2026-58154 | 8.9 | Memory-safety errors in MIME and header parsing | — | Not exploited |
| CVE-2026-58161 | 7.5 | Memory-safety errors in TLS and SNI handling can crash the server | — | Not exploited |
Why it matters
Apache Traffic Server is a caching proxy that powers many content delivery networks. It sits at the network edge and handles huge request volumes. So any bug here can affect a large slice of web traffic.
Several of these Apache Traffic Server vulnerabilities let attackers slip past security controls. That threatens the trust boundary a proxy is meant to enforce.
How the attacks work
Request smuggling is a recurring theme. CVE-2026-33267 leaves hop-by-hop and internal headers in place from untrusted peers. CVE-2026-58150 fails to reject Transfer-Encoding in HTTP/2 requests. Both let an attacker desynchronize a proxy from its backend.
Policy and access-control bypass
Some flaws weaken filtering. CVE-2026-22068 uses unanchored regular expressions, so substring matches slip past ACL, SNI, and geo controls. CVE-2026-58156 mis-parses ports for an access-control bypass. Other bugs skirt IP checks on certain listeners.
Memory-safety crashes
Four issues carry the top 9.2 score. CVE-2026-58154 stems from memory-safety errors in MIME and header parsing. CVE-2026-58161 crashes the server through TLS and SNI handling. CVE-2026-58179 overflows the stack in the regex_remap plugin. The fourth, CVE-2026-58155, truncates long header names and enables request smuggling.
HTTP/2 and HTTP/3 resource abuse
Protocol handling drew heavy scrutiny. CVE-2026-58151 abuses HTTP/2 framing to exhaust resources. CVE-2026-65324 drops a per-stream buffer cap during dechunking. A slow client can then drain server memory.
Plugin and cache bugs
Many flaws sit in optional plugins. The txn_box, uri_signing, and header_rewrite plugins can crash or corrupt memory on hostile input. The ESI plugin can recurse without limit and fetch attacker-chosen URLs, which invites server-side request forgery. Faulty on-disk cache handling can also corrupt state.
Affected versions
The bugs affect Apache Traffic Server 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3. A few issues touch only the 10.x line. Researcher Omkhar Arasaratnam reported many of them, alongside the wider Apache community.
Patch and mitigation
Upgrade without delay. 9.x users should move to 9.2.15, and 10.x users to 10.1.4. Apache lists no configuration workarounds for this batch. Review the full Apache advisory to map each CVE to your setup. So far, the project reports no active attacks against these Apache Traffic Server vulnerabilities.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
