https://seclists.org/oss-sec/2026/q4/30: CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced (supersedes CVE-2026-41920)

Q: Which installations need to be re-evaluated because of the superseded CVE record?

All Apache Traffic Server 9.2.x releases before 9.2.15 are affected. Organizations that treated 9.2.x as unaffected based on CVE-2026-41920 should reassess those installations.

Q: What versions should be deployed to remediate the issue?

Upgrade the 9.x branch to 9.2.15 or the 10.x branch to 10.1.4. The affected ranges are 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3.

Published Oct 2, 2026

Updated

Affected Software

1 affected component

Apache Traffic Server>=9.0.0<=9.2.14, >=10.0.0<=10.1.3

Frequently Asked Questions

Which installations need to be re-evaluated because of the superseded CVE record?

All Apache Traffic Server 9.2.x releases before 9.2.15 are affected. Organizations that treated 9.2.x as unaffected based on CVE-2026-41920 should reassess those installations.

What versions should be deployed to remediate the issue?

Upgrade the 9.x branch to 9.2.15 or the 10.x branch to 10.1.4. The affected ranges are 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3.

https://seclists.org/oss-sec/2026/q4/30: CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced (supersedes CVE-2026-41920)

Affected Software

Frequently Asked Questions

Which installations need to be re-evaluated because of the superseded CVE record?

What versions should be deployed to remediate the issue?

Company

Resources

Contact