Apache Traffic Server: heap-buffer-overflow via HTTP Host header (unbounded alloca pattern, 5 sites) — 90-day disclosure
Reporter: Innora Security Research (feng () innora ai) Target: Apache Traffic Server master (verified on HEAD <= 82605c6 at report time; pattern still present on master as of 2026-11-03, HttpTransact.cc:1573) Weakness: CWE-787 Out-of-bounds Write (heap-buffer-overflow, ASAN-verified) Companion: CWE-789 Memory Allocation with Excessive Size Value Severity: Medium-High (CVSS 6.4 — AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
== Summary ==
Apache Traffic Server contains 5 call sites that pass attacker-controlled lengths to alloca. The primary HTTP-path finding:
In src/proxy/http/HttpTransact.cc (ModifyRequest):
char hostname = staticcast<char >(alloca(hostnamelen + PORTPADDING)); memcpy(hostname, buf.data(), hostnamelen);
where hostnamelen is derived directly from the HTTP Host request header. When an administrator raises both proxy.config.http.requestheadermaxsize and proxy.config.http.headerfieldmaxsize above the worker-thread stack size (defaults are 32 KiB; RECCNULL imposes no upper bound and admins frequently raise these for large-cookie / JWT / custom-header workloads), an unauthenticated remote client can send a Host: header large enough to overflow.
ASAN-verified result: ==10==ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 10485760 at 0x7fffee913818 thread T10 Triggered chain: NetHandler::processreadylist -> UnixNetVConnection::netreadio -> HttpSM::statereadclientrequestheader -> HttpSM::calltransactandsetnextstate -> HttpTransact::ModifyRequest -> asanmemcpy. Crash signal 6, ATS process aborts, all in-flight connections dropped.
== Pre-conditions (honest scope) ==
Two static-config options gate the trigger; both are RECCNULL (src/records/RecordsConfig.cc:574), meaning ATS imposes no upper bound:
proxy.config.http.requestheadermaxsize (default 32768; trigger > 8 MiB) proxy.config.http.headerfieldmaxsize (default 32768; trigger > 8 MiB)
This is an admin-misconfiguration-dependent remote trigger, not a default-config exploit. The plugin-API path (4 additional alloca sites on caller-controlled sizes in InkAPI.cc) is Medium severity (local high-priv).
== Suggested fix ==
Replace alloca with heap allocation (atsmalloc or std::string) for hostname construction, and impose hard upper bounds on the two RECCNULL config options. A class-wide audit of alloca(user-controlled-size) sites is warranted (5 sites identified in the original report).
== Disclosure timeline ==
- 2026-05-17 17:34 SGT: full report (10-file evidence tarball, PoC, ASAN logs, upstream PR draft) sent to security () trafficserver apache org (SMTP 250 OK, 24523 bytes). - 2026-05-31: T+14 polite nudge reminder drafted per disclosure policy. - 2026-08-15: 90-day disclosure window expired. No vendor response received at any point. - 2026-11-03: verified the vulnerable pattern is still present on master (HttpTransact.cc:1573). Publishing per 90-day policy.
Full technical report with all 5 alloca sites, ASAN transcripts, PoC and an upstream PR draft available on request to the reporter address.
— Feng Ning / Innora Security Research
Announcement below was posted to the Apache Traffic Server mailing lists a few days ago.
----- Forwarded message from Masakazu Kitajo <maskit () apache org> -----
Date: Tue, 20 Oct 2026 20:07:34 -0600 From: Masakazu Kitajo <maskit () apache org> To: announce () trafficserver apache org, users <users () trafficserver apache org> Subject: [SECURITY] Multiple vulnerabilities fixed in Apache Traffic Server 9.2.16, 10.1.5 and 10.2.1
The following 15 vulnerabilities affecting Apache Traffic Server have been fixed in versions 9.2.16, 10.1.5 and 10.2.1:
============================================================
The Apache Traffic Server experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.
CVE: CVE-2026-111813 - magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
Severity: critical CVSS v3.1: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS v4.0: 10.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Reported By: Apache Community Abraxas Labs The ASF
Vendor: The ASF
Version Affected: ATS 9.0.0 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111813
============================================================
The Apache Traffic Server experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.
CVE: CVE-2026-111804 - wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
Severity: critical CVSS v3.1: 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS v4.0: 8.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Reported By: Omkhar Arasaratnam Apache Community
Vendor: The ASF
Version Affected: ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111804
============================================================
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.
CVE: CVE-2025-31699 - Origin connection still owed a request body is reused, enabling request smuggling
Severity: important CVSS v3.1: 8.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L CVSS v4.0: 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:H/SI:H/SA:L
Reported By: Martin van Kervel Smedshammer Nick Muerdter
Vendor: The ASF
Version Affected: ATS 9.0.0 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2025-31699
============================================================
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.
CVE: CVE-2025-55702 - An unread Expect: 100-continue request body is framed as a new request
Severity: important CVSS v3.1: 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS v4.0: 7.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Reported By: Sebastiano Sartor
Vendor: The ASF
Version Affected: ATS 9.0.0 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2025-55702
============================================================
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.
CVE: CVE-2026-111816 - A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
Severity: important CVSS v3.1: 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N CVSS v4.0: 9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N
Reported By: Apache Community OneZ3r0
Vendor: The ASF
Version Affected: ATS 9.0.0 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111816
============================================================
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.
CVE: CVE-2026-111805 - HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
Severity: important CVSS v3.1: 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVSS v4.0: 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
Reported By: matrixcain (YakLang) Alieldeen Khaled Ali Jesse Yang Alex Williams (Pellera Technologies) VulnCheck (coordinator) The ASF
Vendor: The ASF
Version Affected: ATS 9.0.0 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111805
============================================================
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.
CVE: CVE-2026-111808 - HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
Severity: important CVSS v3.1: 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVSS v4.0: 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
Reported By: Khalilov Moe (LeetProtect) The ASF
Vendor: The ASF
Version Affected: ATS 9.0.0 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111808
============================================================
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.
CVE: CVE-2026-111814 - Default serversessionsharing.match omits MASKCERT, allowing pooled mTLS identity confusion at the origin
Severity: important CVSS v3.1: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS v4.0: 7.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N
Reported By: Craig Taylor
Vendor: The ASF
Version Affected: ATS 9.0.0 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111814
============================================================
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy.
CVE: CVE-2026-111815 - TLS session ticket resumption bypasses per-SNI verifyclient STRICT enforcement
Severity: important CVSS v3.1: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS v4.0: 7.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Reported By: Yonghwa Lee, Xint by Theori
Vendor: The ASF
Version Affected: ATS 9.0.0 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111815
============================================================
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.
CVE: CVE-2026-111810 - Unthrottled per-header diagnostic logging enables a log-flood denial of service
Severity: important CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS v4.0: 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Reported By: Apache Community
Vendor: The ASF
Version Affected: ATS 9.2.15 ATS 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111810
============================================================
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.
CVE: CVE-2026-111809 - HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
Severity: moderate CVSS v3.1: 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N CVSS v4.0: 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N
Reported By: Apache Community
Vendor: The ASF
Version Affected: ATS 9.0.0 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111809
============================================================
The Apache Traffic Server experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.
CVE: CVE-2026-111811 - tsmemcache plugin exposes the shared proxy cache over the network with no authentication
Severity: moderate CVSS v3.1: 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS v4.0: 9.4 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H
Reported By: Apache Community
Vendor: The ASF
Version Affected: ATS 9.0.0 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111811
============================================================
The Apache Traffic Server originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.
CVE: CVE-2026-111812 - originserverauth signs client-controlled AWS headers under the proxy's IAM credentials
Severity: moderate CVSS v3.1: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS v4.0: 7.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Reported By: Apache Community
Vendor: The ASF
Version Affected: ATS 9.0.0 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111812
============================================================
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.dropchunkedtrailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 9.2.x it is off by default, and those versions are affected only if it is enabled.
CVE: CVE-2026-111817 - Dropping chunked trailers stalls a passthrough transfer until timeout
Severity: moderate CVSS v3.1: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS v4.0: 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Reported By: Omkhar Arasaratnam
Vendor: The ASF
Version Affected: ATS 9.2.5 to 9.2.15 ATS 10.0.0 to 10.1.4 ATS 10.2.0
Mitigation: 9.x: no fix is included in 9.2.16; affected only if dropchunkedtrailers is enabled 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-111817
============================================================
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race.
CVE: CVE-2026-112381 - Nullptr dereference in netwriteio on a POST half-close with chunked response
Severity: moderate CVSS v3.1: 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS v4.0: 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Reported By: Masaori Koshiba
Vendor: The ASF
Version Affected: ATS 9.2.15 ATS 10.1.4 ATS 10.2.0
Mitigation: 9.x users should upgrade to 9.2.16 or later versions 10.1.x users should upgrade to 10.1.5 or later versions 10.2.x users should upgrade to 10.2.1 or later versions
Reference: https://www.cve.org/CVERecord?id=CVE-2026-112381
============================================================
Users of all affected versions should upgrade to 9.2.16, 10.1.5 or 10.2.1 as soon as possible.
We would like to thank all reporters credited above, and the Apache Traffic Server community, for identifying and helping resolve these issues.
Regards, Masakazu Kitajo Apache Traffic Server PMC
----- End forwarded message -----
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.
This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.dropchunkedtrailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled.
This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.
This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.
This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
Severity: moderate
Affected versions:
- Apache Traffic Server 9.0.0 through 9.2.14 - Apache Traffic Server 10.0.0 through 10.1.3
Description:
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected. If you concluded from the CVE-2026-41920 advisory that a 9.2.x installation was not affected, please re-evaluate it.
Credit:
JD Marsters (Bhut Red) (reporter) Apache Community (reporter)
References:
https://trafficserver.apache.org/ https://www.cve.org/CVERecord?id=CVE-2026-102795 https://www.cve.org/CVERecord?id=CVE-2026-41920
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server intercept plugin has a use-after-free.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server headerrewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server urisigning and urlsig plugins can exhaust the stack or crash on attacker input.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
The Apache Traffic Server txnbox plugin overflows the stack from attacker-controlled input.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.