EUVD-2026-50221
GHSA-5956-65wj-chxh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ATS resolver over network
-
DeliveryInduce SRV record resolution via HostDB
-
ExploitTrigger unfreed memory allocation
-
ExecutionRepeat to accumulate leak
-
PersistExhaust proxy memory
-
ImpactCrash service / deny availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Exploitation requires that Apache Traffic Server actually process DNS SRV records through its HostDB host-resolution cache - i.e., the deployment must use upstream/origin resolution that returns and consumes SRV records; a configuration that never resolves SRV records will not exercise the leaking code path. This corresponds to the CVSS 4.0 AT:P (attack requirement present) metric: the vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N), but the leak only accumulates when SRV handling is triggered. Limiting factors are the need for repeated triggering to exhaust memory (it is cumulative, not a single-shot crash), the dependency on SRV-based resolution being in use, and affected versions being 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3. |
| Impact | The vendor-supplied CVSS 4.0 score is 8.2 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N and a pure availability impact (VA:H, SA:L; VC/VI = N), meaning network-reachable and unauthenticated but gated by an attack requirement (AT:P) - the leak only triggers under the specific condition that SRV records flow through HostDB, which depends on upstream DNS/service configuration. EPSS is not provided, the CVE is not in CISA KEV, and no POC is referenced, so this is a real but non-emergency availability issue rather than an actively exploited critical. Note a signal conflict: the vendor tag labels this 'Information Disclosure,' but both CWE-401 and the CVSS vector (C:N/I:N, A:H) indicate resource exhaustion / DoS, not data leakage - treat it as an availability/DoS issue and verify with the vendor advisory if confidentiality impact is a concern. |
| Exploit ScenarioDerived | An attacker who can influence the DNS responses ATS resolves - for example by controlling or spoofing SRV records returned for an upstream/origin lookup - repeatedly drives SRV-record processing through HostDB, causing memory to leak on each cycle. Over time the proxy's memory footprint grows until it is exhausted, degrading throughput and ultimately crashing the service and denying availability to all clients behind it. No public exploit code has been identified, and the attack requirement (AT:P) means the SRV-processing path must actually be exercised. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 29, 2026
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory leak in the HostDB code path that processes DNS SRV records, allowing remote attackers to progressively exhaust proxy memory and degrade or crash the service. The CVSS 4.0 vector (8.2, VA:H) points to an availability impact rather than the information disclosure implied by the vendor tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Earlier versions of this analysis (2)
Uncontrolled memory consumption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows remote attackers to exhaust server memory through the HostDB component's handling of DNS SRV records, degrading or denying service on this caching/forwarding proxy. The CVSS 4.0 base score is 8.2, driven entirely by high availability impact (VA:H) with no confidentiality or integrity impact, and exploitation carries an attack-requirement condition (AT:P). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Memory exhaustion in Apache Traffic Server's HostDB SRV record handling allows unauthenticated remote attackers to cause denial of service by triggering unreclaimed memory allocations. All three supported major branches (8.x, 9.x, 10.x) are affected across a wide version span, with fixed versions available only for the 9.x and 10.x lines. No public exploit code or CISA KEV listing has been identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector means any internet-facing ATS instance is potentially reachable without any special preconditions.
RemediationAI
Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line) as the primary fix, per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Users on the 8.x line (8.0.0-8.1.9) have no listed fixed version and should migrate to a supported 9.2.15+ or 10.1.4+ build. If immediate patching is not possible, compensating controls include disabling or avoiding upstream configurations that resolve SRV records through HostDB (removing SRV-based origin/service discovery so the leaking path is not exercised), tightening or pinning DNS resolution to non-SRV records where feasible, and instituting scheduled restarts of ATS processes to reclaim leaked memory - with the trade-off that SRV-based load balancing/failover is lost and periodic restarts briefly interrupt caching and connection state. Monitor RSS/heap growth of the ATS process as an early-warning control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Traffic Server (ATS) is a high-performance HTTP caching proxy and reverse/forward proxy widely used at CDN and edge scale. HostDB is its internal host-resolution cache, which stores DNS results including SRV records used for service discovery when ATS resolves upstream/origin endpoints. The flaw is classified as CWE-401 (Missing Release of Memory After Effective Lifetime): when ATS handles HostDB SRV record entries, allocated memory is not freed, so each processing cycle incrementally consumes heap until resources are exhausted. Because SRV record handling is tied to DNS resolution behavior, the leak accumulates over the proxy's lifetime rather than causing an immediate crash.
Know when Apache Traffic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Network-reachable and unauthenticated, but the SRV-through-HostDB precondition and cumulative triggering map to AC:H; impact is availability-only (A:H), with no confidentiality or integrity effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Apache Traffic Server leaks memory when handling HostDB SRV records.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Executive ViewAI
Apache Traffic Server versions 8.0.0 through 10.1.3 contain a memory leak vulnerability that enables remote attackers to cause service outages through resource exhaustion. Organizations operating Traffic Server in production infrastructure face unplanned downtime risk, with no vendor-released patch identified at time of analysis.
Rate limit DNS SRV query processing; implement automated memory monitoring with failover triggers; restrict DNS query sources to trusted nameservers only; deploy with process-level resource limits (cgroups/containers) to prevent host-level cascade failure; maintain warm standby instances for rapid failover upon memory exhaustion detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Apache Traffic Server
View allApache Traffic Server versions 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 ship an exp
Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and
Request smuggling in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be driven into a denial-of-service condition through log amplificat
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Exploit-DB