CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.15 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.4
Event History
Frequently Asked Questions
Which Apache Traffic Server deployments need to be remediated?
Apache Traffic Server versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 are affected. Upgrade to 9.2.15 or 10.1.4, as applicable.
Is this exploitable remotely without authentication or user interaction?
Yes. The supplied CVSS vector identifies network attack access, low attack complexity, no required privileges, and no user interaction.
Does this replace an earlier CVE record?
Yes. This CVE supersedes CVE-2026-41920; in particular, it clarifies that all 9.2.x releases before 9.2.15 are affected.