EUVD-2026-50204
GHSA-3mm3-f2hp-jpcj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable HPACK/XPACK parser requires precisely crafted integer encoding (AC:H); no authentication needed; impact is crash-only with no confidentiality or integrity exposure.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AnalysisAI
Memory corruption in Apache Traffic Server during HPACK/XPACK header decoding exposes affected deployments to denial of service. Versions spanning the 8.x, 9.x, and 10.x release lines are affected, with unauthenticated remote attackers able to craft malformed compressed headers that trigger an integer overflow (CWE-190), corrupting server memory. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 5.9 Medium, reflecting that while no authentication is required, elevated attack complexity limits opportunistic mass exploitation; no public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
Technical ContextAI
Apache Traffic Server (ATS) is a high-performance, open-source HTTP proxy and caching server widely used in CDN and reverse-proxy deployments. HPACK is the header compression algorithm mandated by HTTP/2 (RFC 7541), and XPACK is its counterpart for HTTP/3 over QUIC. Both formats encode header field lengths and indices as variable-length integers; the root cause is CWE-190 (Integer Overflow or Wraparound) - when ATS decodes these integers, it performs arithmetic that can exceed the expected integer bounds, producing a corrupted value used for memory operations. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_traffic_server across the 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 ranges. This class of bug in protocol header parsers is well-understood and historically leads to heap corruption, typically manifesting as a crash rather than arbitrary code execution when integer semantics do not directly control a write primitive.
RemediationAI
Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, both of which are confirmed by the vendor as fixing this issue per the advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. The 8.x branch has no fix version listed; operators on 8.x should migrate to a supported release branch immediately. If an immediate upgrade is not feasible, consider restricting HTTP/2 and HTTP/3 (QUIC) traffic to trusted upstream sources via network ACLs or an edge load balancer that validates HPACK/XPACK encoding before forwarding - note this adds latency and may not be complete protection. Disabling HTTP/2 and HTTP/3 support in the ATS configuration entirely eliminates the attack surface but degrades protocol performance and compatibility with modern clients. No patch is available for the 8.x branch.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today