EUVD-2026-50221
GHSA-5956-65wj-chxh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated, but the SRV-through-HostDB precondition and cumulative triggering map to AC:H; impact is availability-only (A:H), with no confidentiality or integrity effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
7DescriptionCVE.org
Apache Traffic Server leaks memory when handling HostDB SRV records.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AnalysisAI
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory leak in the HostDB code path that processes DNS SRV records, allowing remote attackers to progressively exhaust proxy memory and degrade or crash the service. The CVSS 4.0 vector (8.2, VA:H) points to an availability impact rather than the information disclosure implied by the vendor tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Apache Traffic Server (ATS) is a high-performance HTTP caching proxy and reverse/forward proxy widely used at CDN and edge scale. HostDB is its internal host-resolution cache, which stores DNS results including SRV records used for service discovery when ATS resolves upstream/origin endpoints. The flaw is classified as CWE-401 (Missing Release of Memory After Effective Lifetime): when ATS handles HostDB SRV record entries, allocated memory is not freed, so each processing cycle incrementally consumes heap until resources are exhausted. Because SRV record handling is tied to DNS resolution behavior, the leak accumulates over the proxy's lifetime rather than causing an immediate crash.
RemediationAI
Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line) as the primary fix, per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Users on the 8.x line (8.0.0-8.1.9) have no listed fixed version and should migrate to a supported 9.2.15+ or 10.1.4+ build. If immediate patching is not possible, compensating controls include disabling or avoiding upstream configurations that resolve SRV records through HostDB (removing SRV-based origin/service discovery so the leaking path is not exercised), tightening or pinning DNS resolution to non-SRV records where feasible, and instituting scheduled restarts of ATS processes to reclaim leaked memory - with the trade-off that SRV-based load balancing/failover is lost and periodic restarts briefly interrupt caching and connection state. Monitor RSS/heap growth of the ATS process as an early-warning control.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Same weakness CWE-401 – Memory Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today