Apache Traffic Server CVE-2026-33267

Exploitation requires network reach to an affected Apache Traffic Server instance (9.2.0-9.2.14 or 10.1.0-10.1.3) operating in its proxy role, and the ability to send crafted/malformed HTTP input that triggers the improper validation; per CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no special attack requirements, and no user interaction are needed against a reachable instance. The main limiting factors are version (only the listed ranges are affected - 9.2.15/10.1.4 and later are not) and deployment exposure: impact is realized against systems downstream of the proxy (SI:H), so the risk is highest where ATS forwards to sensitive backends and is reachable from untrusted networks. The exact triggering feature/parsing path is not detailed in the provided advisory text and should be confirmed against the Apache thread.

Signals are moderately consistent but incomplete. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction - an easy-to-reach precondition set - while the impact is narrow: only subsequent-system integrity is High (SI:H), with VC/VI/VA and confidentiality/availability all None, yielding 7.7. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from the input; the absence of KEV/POC means there is no evidence of active exploitation or public weaponization. One conflict to flag: the vendor Tags label this 'Information Disclosure', but the authoritative CVSS vector sets confidentiality to N and integrity (subsequent system) to H - these disagree on impact type; treat the CVSS integrity framing as primary and verify the exact behavior against the Apache advisory. Net: a real, patch-now issue for internet-facing ATS proxies given the trivial preconditions, but scoped to integrity/traffic-manipulation rather than data theft or DoS.

An attacker sends a crafted HTTP request with malformed or ambiguous framing/headers to an internet-facing Apache Traffic Server proxy on an affected version. Because ATS improperly validates the input, the request is relayed to a backend in a way the backend interprets differently, letting the attacker manipulate or poison downstream traffic (e.g. smuggle a second request or alter a cached/relayed response). No authentication or user interaction is required, but no public POC has been identified at time of analysis.