EUVD-2026-50168
GHSA-mhwr-5c6p-qj97
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable proxy, no auth or interaction needed; high confidentiality loss from access control bypass, limited integrity, no availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Regular Expression without Anchors vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
AnalysisAI
Unanchored regular expression matching in Apache Traffic Server exposes a high-severity bypass that allows remote unauthenticated attackers to circumvent regex-based access controls, potentially leaking protected content (C:H) and enabling limited unauthorized writes (I:L). All 9.0.x through 9.2.14 and 10.0.x through 10.1.3 deployments that rely on regex-driven rules for routing, ACL, or header policy enforcement are at risk. No public exploit code has been identified at time of analysis, and CISA has not listed this in KEV, but the low-complexity, unauthenticated network attack path makes it a realistic opportunistic target for any actor aware of the flaw.
Technical ContextAI
Apache Traffic Server (ATS) is a high-performance reverse proxy and HTTP caching layer used in large-scale CDN and load-balancing infrastructures (CPE: cpe:2.3:a:apache_software_foundation:apache_traffic_server). The root cause is CWE-777 - Regular Expression without Anchors - where a security-relevant regex pattern lacks start (^) or end ($) anchors. Without anchors, a pattern intended to match only a specific URI path, hostname, or header value will also match any string that contains the target pattern as a substring. In ATS, such regex rules govern ACL decisions, plugin behavior, or header rewriting. An attacker can craft a request whose path or header embeds the expected token as a substring while containing additional untrusted content, causing ATS to incorrectly treat the request as matching the intended policy and granting it elevated access or forwarding it to protected upstream resources.
RemediationAI
Upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line), both confirmed as patched releases per the vendor advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. If immediate upgrade is not feasible, audit all regex patterns configured in remap.config, parent.config, and plugin configurations to manually add ^ and $ anchors to any pattern used for security-enforcement decisions - this directly addresses the root CWE-777 condition, though operator-applied fixes carry risk of misconfiguration and do not replace the vendor patch. As a compensating control, place ATS behind a WAF or upstream proxy that independently enforces URI and header allow-listing, reducing reliance on ATS-internal regex ACLs; note this adds latency and operational complexity. Avoid relying on regex-based access control in ATS as the sole enforcement layer until patched.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today