EUVD-2026-50233
GHSA-g2hg-96vq-xgmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ATS proxy
-
DeliverySend crafted HTTP request
-
ExploitTrigger out-of-bounds write in experimental plugin
-
ExecutionCorrupt process memory
-
ImpactCrash proxy or disclose memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target Apache Traffic Server instance to have been built with and to have enabled one of the affected experimental plugins - this is the concrete precondition captured by the CVSS 4.0 AT:P (Attack Requirements: Present) metric, and it is the primary limiting factor since stock deployments that do not compile or load these experimental plugins are not exploitable. Where such a plugin is active, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with no user interaction against the exposed proxy; the specific plugins and their exact trigger inputs are not enumerated in the available data and should be confirmed against the vendor advisory. |
| Impact | The CVSS 4.0 base score is 8.4 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H, indicating a network-reachable, unauthenticated, no-user-interaction issue with high confidentiality and availability impact - but the AT:P (Attack Requirements: Present) metric signals that a specific non-default precondition must hold, consistent with the plugins being experimental and optionally enabled. No EPSS score was supplied, so exploitation probability cannot be quantified from the input; KEV status is not present (no active exploitation), and no POC/exploit code is referenced. On balance this is a genuine memory-corruption issue worth prompt patching for operators who run the affected experimental plugins, but the real-world exposure is materially narrower than the raw 8.4 suggests because default ATS deployments that do not compile or enable these plugins are not affected. Note the tension to verify with the vendor: the vector advertises AV:N/PR:N (broad remote exploitability) while the description confines impact to experimental plugins - the AT:P flag is the reconciling factor and should be read as 'remotely exploitable only where those plugins are active.' |
| Exploit ScenarioDerived | An attacker who identifies an ATS edge node running one of the vulnerable experimental plugins sends a crafted HTTP request whose contents drive the plugin to write beyond an allocated buffer, corrupting memory. With no authentication or user interaction required on an exposed instance, this can crash the proxy (availability loss) or leak/alter memory contents (confidentiality and limited integrity impact); no public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 29, 2026
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Earlier versions of this analysis (1)
Out-of-bounds write and limit-bypass flaws in Apache Traffic Server's experimental plugins expose deployments across three major release branches (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) to network-exploitable denial of service and limited integrity corruption. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation with low complexity, making this a priority for operators running ATS with experimental plugins enabled. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has released fixes in 9.2.15 and 10.1.4.
RemediationAI
Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 8.x and 9.x branches) or 10.1.4 (for the 10.x branch), as stated in the Apache advisory (https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d); note that the 8.x branch has no dedicated fixed release listed, so 8.x users should migrate to 9.2.15 or later. As an immediate compensating control until patching, disable or unload the affected experimental plugins in remap.config/plugin.config and rebuild without them, accepting the trade-off of losing whatever functionality those plugins provided; if a specific experimental plugin is required, restrict which clients can reach the routes it processes at the network or ACL layer to shrink the attack surface. Because the fix branches are tagged releases, prefer the upgrade over long-term reliance on plugin removal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Traffic Server (ATS) is a high-performance, open-source forward and reverse proxy/caching server maintained by the Apache Software Foundation and commonly used as an edge caching and load-balancing layer. Beyond its core, ATS ships a collection of optional plugins, some marked 'experimental,' that extend request/response handling; this advisory concerns memory-safety and limit-bypass defects within several of those experimental plugins. The root cause maps to CWE-787 (Out-of-bounds Write), meaning attacker-influenced input causes the plugin to write past the bounds of an allocated buffer - the classic buffer-overflow / memory-corruption pattern also reflected in the tags. The single CPE provided (cpe:2.3:a:apache_software_foundation:apache_traffic_server) is version-agnostic and does not itself enumerate the affected experimental plugin modules.
Know when Apache Traffic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
AV:N and PR:N because the proxy is network-facing and unauthenticated, but AC:H reflects the required non-default experimental-plugin configuration (mapped from CVSS 4.0 AT:P).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Executive ViewAI
Apache Traffic Server versions 8.0-10.1 contain a memory corruption vulnerability in experimental plugins that could lead to service disruption and unauthorized data access. The risk is limited to organizations that have explicitly built and enabled experimental plugins beyond the default configuration. No vendor patch is currently available, requiring immediate detection and containment of affected deployments.
Disable experimental plugins in affected versions (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3). Restrict network access to Apache Traffic Server instances via firewall rules and application-level controls. Deploy continuous monitoring for abnormal memory or process behavior on affected systems. Ensure current backup and disaster recovery procedures are tested and available. Subscribe to Apache Software Foundation security mailing lists for patch notifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Apache Traffic Server
View allApache Traffic Server versions 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 ship an exp
Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and
Request smuggling in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be driven into a denial-of-service condition through log amplificat
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Exploit-DB