EUVD-2026-50234
GHSA-f54r-392m-jmr7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated, but the required counter-resetting plugin raises AC:H; amplification affects backend availability (S:C, A:H) with no confidentiality or integrity impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6DescriptionCVE.org
Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AnalysisAI
Server-Side Request Forgery amplification in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to bypass the configured redirect-follow limit when a plugin resets the internal retry counter, letting a single request fan out into a large chain of proxy-originated requests. The CVSS 4.0 base score is 8.2 (High), reflecting high impact on availability rather than data disclosure, with an attack requirement (AT:P) tied to specific plugin behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Apache Traffic Server (ATS) is a high-performance, open-source forward and reverse HTTP caching proxy widely used at the edge of CDNs and large web infrastructures. The flaw is classified as CWE-918 (Server-Side Request Forgery): ATS follows HTTP redirects on behalf of clients and enforces a maximum redirect count to prevent runaway request chains, but that safeguard is defeated when a plugin resets the retry/redirect counter mid-processing. Because the counter no longer monotonically bounds the number of followed redirects, ATS can be coerced into issuing an unbounded or greatly multiplied set of outbound requests. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_traffic_server, and the amplification behavior is the mechanism converting a single inbound request into many proxy-originated outbound requests.
RemediationAI
Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 8.x and 9.x lines) or 10.1.4 (for the 10.x line), as directed in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Because exploitation requires a plugin that resets the redirect/retry counter, an immediate compensating control where patching must be deferred is to audit and disable any custom or third-party plugins that manipulate redirect retry handling, and to disable proxy redirect-following (do not follow upstream 3xx redirects on behalf of clients) if your deployment does not require it - the trade-off is that legitimate redirect-following behavior for backends and clients will break. Additionally, rate-limit outbound proxy requests and restrict which upstream/backend destinations ATS may reach so that any amplified request chain is bounded and cannot be aimed at internal infrastructure; the side effect is added configuration overhead and potential blocking of legitimate but unlisted upstreams.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today