CVE-2026-65325: Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification
Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.15 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65325?
The severity of CVE-2026-65325 is medium, with a score of 4.8.
How do I fix CVE-2026-65325?
To fix CVE-2026-65325, upgrade Apache Traffic Server to version 9.2.15 or 10.1.4.
What impact does CVE-2026-65325 have on Apache Traffic Server?
CVE-2026-65325 allows for the reuse of multiplexed HTTP/2 origin connections without proper server certificate verification, posing a security risk.
Which versions of Apache Traffic Server are affected by CVE-2026-65325?
Apache Traffic Server versions from 9.0.0 through 9.2.14 and from 10.0.0 through 10.1.3 are affected by CVE-2026-65325.
Is CVE-2026-65325 remotely exploitable?
Yes, CVE-2026-65325 has an attack vector that is classified as remote.