EUVD-2026-50211
GHSA-99g5-7fmc-568c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ATS PROXY-protocol listener
-
DeliveryOpen TCP connection
-
ExploitSend crafted PROXY header with malformed port
-
ExecutionTruncated port overflows stack buffer
-
ImpactCrash proxy process / deny service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected ATS listener must be configured to accept the PROXY protocol on inbound connections (the AT:P Attack Requirement in the CVSS vector) - this is not a default configuration, so instances that never enable PROXY protocol acceptance are not exposed. When enabled, no authentication or user interaction is required (PR:N/UI:N) and the malformed PROXY header can be delivered by any client able to open a TCP connection to that listener. Exploitation is limited by whether the PROXY-protocol port is exposed only to trusted upstream balancers versus reachable by untrusted clients, and by the affected version ranges (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3); confirmed impact is service crash/DoS rather than data compromise. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) tells a nuanced story: exploitation is network-reachable, low-complexity, and unauthenticated, but carries an Attack Requirement (AT:P) - the PROXY protocol feature must be enabled, which is not the default. Vendor-assessed impact is strictly availability (VA:H) with no confidentiality or integrity loss, i.e. a crash/DoS rather than confirmed code execution, which keeps the base score at 8.2 rather than a critical 9+. However, CWE-121 stack overflows can sometimes be escalated to code execution, so the availability-only rating may be conservative - treat integrity impact as unverified rather than ruled out. No EPSS score was provided, so exploitation probability cannot be quantified; there is no POC and no KEV listing, so this is a real-but-not-emergency priority: urgent for environments that actually terminate PROXY protocol at ATS, lower for those that do not enable it. The gating AT:P condition is the single most important signal for prioritization. |
| Exploit ScenarioDerived | An attacker who can reach an ATS listener that is configured to accept the PROXY protocol opens a TCP connection and sends a crafted PROXY header with a malformed/oversized port field. ATS truncates the port and overflows a fixed stack buffer while parsing, crashing the proxy process and denying service to legitimate traffic; because the overflow is on the stack, escalation beyond DoS cannot be excluded. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 29, 2026
Denial-of-service (and potential memory-corruption) in Apache Traffic Server arises from mishandling of PROXY protocol input, where malformed port fields are truncated and cause a stack buffer overflow (CWE-121). Affected releases span the 8.x, 9.x, and 10.x branches (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), and remote attackers can crash the proxy when it is configured to accept PROXY protocol connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor scores the impact as availability-only (CVSS 4.0 base 8.2).
Earlier versions of this analysis (2)
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from improper handling of PROXY protocol input, where port values are truncated and a stack buffer is overflowed. Reachable by remote attackers whose traffic is accepted as PROXY protocol input, an attacker can crash the proxy and interrupt service; the vendor-assigned CVSS 4.0 vector rates only availability impact (VA:H), consistent with a stack smash that destabilizes the process rather than confirmed code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in Apache Traffic Server's PROXY protocol parser allows remote unauthenticated attackers to crash the proxy service across three major version branches. The flaw exists in versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and stems from improper port value handling during PROXY protocol header parsing - a truncation error that corrupts the stack and causes a process crash. No public exploit or active exploitation has been identified at time of analysis; vendor-released patches are available in 9.2.15 and 10.1.4.
RemediationAI
Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 8.x and 9.x branches) or 10.1.4 (for the 10.x branch) per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d; 8.x is EOL and has no in-branch fix, so 8.x operators should move to 9.2.15 or later. As a compensating control until patching, disable or tightly scope PROXY protocol acceptance on inbound listeners (e.g. remove the accept-proxy/PROXY-protocol setting from proxy.config on affected ports, or clear the proxy protocol allowlist) - the trade-off is that ATS will then log the upstream balancer's IP instead of the real client IP, breaking client-IP-based ACLs, logging, and rate limiting. Alternatively, restrict the ports that speak PROXY protocol so they are reachable only from trusted upstream load balancers via network ACLs/firewalling, which preserves client-IP recovery but requires that the upstream path itself be trusted and non-spoofable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Traffic Server (ATS) is a high-performance forward/reverse caching HTTP proxy commonly deployed at the edge of CDN and load-balanced infrastructures. The PROXY protocol (originating with HAProxy) is a small header prepended to a TCP connection so that a downstream proxy like ATS can recover the real client IP and port when it sits behind another L4/L7 balancer. The flaw is CWE-121 (stack-based buffer overflow): while parsing the PROXY header, ATS truncates the port value and writes beyond a fixed-size stack buffer. The single CPE published (cpe:2.3:a:apache_software_foundation:apache_traffic_server:*) covers all affected branches, and the tags (Buffer Overflow, Stack Overflow) corroborate the root cause. Because the parsing occurs before normal request handling, the overflow is reachable on any listener where PROXY protocol acceptance has been enabled.
Know when Apache Traffic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable and unauthenticated, but AC:H because the non-default PROXY-protocol feature must be enabled; impact is availability-only (crash), so C:N/I:N/A:H.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Executive ViewAI
Apache Traffic Server proxy infrastructure (versions 8.x, 9.x, and 10.x) is vulnerable to remote denial-of-service attacks through malformed PROXY protocol input, risking service unavailability for customer traffic and potentially cascading failures across dependent applications. No vendor patch is currently available, requiring immediate deployment of compensating controls to protect critical proxy operations.
Disable PROXY protocol on affected versions if not operationally required. If PROXY protocol must remain enabled: implement firewall or cloud security group rules restricting PROXY protocol port access to only trusted upstream systems; enable connection-level rate limiting to degrade exploit throughput; configure monitoring and alerting on proxy service crashes and unexpected restarts as early indicators of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Apache Traffic Server
View allApache Traffic Server versions 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 ship an exp
Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and
Request smuggling in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be driven into a denial-of-service condition through log amplificat
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Exploit-DB