CVE-2026-33267: Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.2.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33267?
CVE-2026-33267 has a critical severity rating of 10.
How do I fix CVE-2026-33267?
To fix CVE-2026-33267, upgrade Apache Traffic Server to version 9.2.15 or 10.1.4.
What components are affected by CVE-2026-33267?
CVE-2026-33267 affects Apache Traffic Server versions 9.2.0 through 9.2.14 and 10.1.0 through 10.1.3.
What is the nature of the vulnerability in CVE-2026-33267?
CVE-2026-33267 is an improper input validation vulnerability that allows untrusted @ headers to spoof internal metadata.
When was CVE-2026-33267 published?
CVE-2026-33267 was published on July 29, 2026.