EUVD-2026-50232
GHSA-xq5v-8whr-7mvx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain control or influence over upstream origin server
-
DeliveryCraft malformed chunked-encoding response
-
ExploitDeliver response to ATS multiplexer plugin
-
ExecutionTrigger chunk-decode buffer overrun (CWE-787)
-
ImpactCause ATS process crash or service unavailability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Apache Traffic Server multiplexer plugin is loaded and actively processing upstream responses. The attack vector is upstream-facing, not client-facing: the attacker must control or meaningfully influence the chunked-encoded responses returned by an upstream origin server that ATS is proxying - this is not a direct attack from an internet client to ATS. CVSS AV:N/AC:H/PR:N/UI:N indicates network reachability without authentication but with high complexity, consistent with the upstream-input dependency. Impact is strictly limited to denial of service (A:L); confidentiality and integrity are unaffected. Deployments that do not load the multiplexer plugin are not affected, regardless of ATS version. |
| Impact | The CVSS 3.7 Low score accurately reflects the constrained risk posture of this vulnerability. AV:N confirms the attack is network-reachable, but AC:H signals that exploitation is not straightforward - the attacker must be positioned to influence upstream origin responses reaching the ATS multiplexer, which is an atypical and non-trivial capability for external attackers. PR:N/UI:N confirms no authentication or client interaction is required once upstream access is achieved. Impact is limited to A:L (partial availability), with C:N and I:N ruling out data theft or tampering. No EPSS score was provided, so probabilistic likelihood cannot be quantified. No KEV listing and no public POC have been identified, further reducing urgency. This is a genuine but low-priority vulnerability: operationally significant only for high-uptime ATS deployments where adversaries may realistically control upstream origin infrastructure, or where an upstream server is already compromised and being used as a pivot. |
| Exploit ScenarioDerived | An attacker who has compromised or can manipulate a configured upstream origin server sends a crafted HTTP response containing malformed chunked transfer encoding to an Apache Traffic Server instance running the multiplexer plugin. The chunk-decode buffer is overrun, causing the plugin or the ATS worker process to crash and denying service to downstream clients. No public POC has been identified, and the AC:H complexity rating reflects that reliable exploitation depends on upstream response control, not direct client-to-ATS crafted input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Buffer overrun in the Apache Traffic Server multiplexer plugin's chunk-decode logic allows network-adjacent attackers who can influence upstream origin responses to cause denial of service across versions 8.0.0 through 10.1.3. The flaw is classified as CWE-787 (Out-of-bounds Write) and is constrained to availability impact only - no code execution or data exposure is indicated. No public exploit or CISA KEV listing has been identified, and the CVSS 3.7 Low score reflects meaningful real-world limitations, primarily the high attack complexity imposed by the upstream-input dependency.
RemediationAI
Vendor-released patches are available: upgrade to Apache Traffic Server 9.2.15 (for 9.x users) or 10.1.4 (for 10.x users), as confirmed by the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Users on the 8.x branch should migrate to 9.2.15 or 10.1.4, as no 8.x fix has been identified. As a compensating control, if the multiplexer plugin is not functionally required, disabling it entirely eliminates the attack surface - the trade-off is loss of request fan-out and response multiplexing capabilities. Where the plugin must remain active, restricting the trust boundary of upstream origins (e.g., only connecting to internally controlled origin servers) significantly reduces the realistic attacker capability to deliver malformed chunked responses.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Traffic Server (ATS) is a high-performance caching reverse proxy used by large web operators and CDN deployments. The affected component is the multiplexer plugin, which fans out requests to multiple upstream origin servers and reassembles responses. Within this plugin, the chunk-decode buffer - responsible for parsing HTTP chunked transfer encoding received from upstream origins - can be overrun (CWE-787: Out-of-bounds Write) when processing malformed or adversarially crafted upstream input. The CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server covers all three affected version branches: 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3. The tags 'Buffer Overflow' and 'Memory Corruption' confirm the memory-safety nature of the root cause; however, the CVSS impact metrics (C:N/I:N/A:L) indicate the overrun does not yield arbitrary code execution in practice, limiting the blast radius to service disruption.
Know when Apache Traffic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Upstream-controlled input dependency justifies AC:H; DoS-only buffer overrun with no code execution path yields A:L and C:N/I:N.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
2DescriptionCVE.org
The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apache Traffic Server
View allApache Traffic Server versions 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 ship an exp
Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and
Request smuggling in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be driven into a denial-of-service condition through log amplificat
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Exploit-DB