Which versions of Apache Traffic Server are affected by CVE-2026-65324?

Apache Traffic Server (versions 8.0.0-10.1.3) suffers from a memory-exhaustion vulnerability that allows unauthenticated attackers to crash or severely degrade caching proxy services.

How to fix or mitigate CVE-2026-65324?

Within 24 hours, complete an inventory of all Apache Traffic Server instances and identify those running versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3, then implement aggressive connection timeouts and rate-limiting policies at the load balancer or network gateway to terminate slow-client connections before they exhaust buffers. Within 7 days, deploy real-time memory monitoring and alerting on affected servers to detect early warning signs of the attack, configure per-stream buffer limits to the minimum acceptable value for legitimate traffic, and document all deployed interim controls. Within 30 days, monitor Apache Traffic Server security advisories for patch releases addressing the affected versions, conduct load-testing to ensure interim controls do not impact legitimate users, and develop an upgrade timeline for patched versions once vendors release fixes (expected versions after 8.1.9, 9.2.14, and 10.1.3).

Apache Traffic Server CVE-2026-65324

Q: What is the CVSS score of CVE-2026-65324?

CVE-2026-65324 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50206 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-29 apache

GHSA-q67c-46w2-2p7h

Denial Of Service Apache Apache Traffic Server Apache Software Foundation

8.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote unauthenticated slow-client trigger with no privileges or user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only memory exhaustion, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 09:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 09:22 vuln.today

cvss_changed

CVSS changed

Jul 29, 2026 - 09:22 NVD

7.5 (HIGH) 8.2 (HIGH)

Analysis Generated

Jul 29, 2026 - 08:50 vuln.today

CVE Published

Jul 29, 2026 - 08:17 cve.org

HIGH 7.5

DescriptionCVE.org

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Memory-exhaustion denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy drops its per-stream buffer cap while dechunking HTTP/2 or HTTP/3 responses. A remote, unauthenticated attacker acting as a deliberately slow client can force unbounded buffering and exhaust server memory, degrading or crashing the caching proxy. This is a pure availability issue (CWE-400) with no confidentiality or integrity impact; no public exploit has been identified at time of analysis.

Technical ContextAI

Apache Traffic Server is a high-performance caching HTTP/HTTPS forward and reverse proxy widely used in CDN and edge-caching deployments. The flaw sits in its HTTP/2 and HTTP/3 response-handling path: when the server dechunks (removes chunked transfer-encoding framing from) an upstream response before delivering it to the client, it fails to enforce the per-stream buffer limit that normally bounds how much data can accumulate in memory for a single stream. This is a classic CWE-400 Uncontrolled Resource Consumption pattern - a missing or bypassed flow-control/backpressure check lets a client that reads slowly cause the server to buffer response bytes without bound. The CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server covers all affected branches.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 or 10.1.4, which restore the per-stream buffer cap during dechunking (advisory: https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d). Users still on the 8.0.0-8.1.9 branch should migrate to a fixed 9.2.15 or 10.1.4 release, since no patched 8.x version is named. Where immediate upgrade is not possible, compensating controls include disabling HTTP/2 and HTTP/3 support so responses are not handled by the vulnerable dechunking path (trade-off: loss of multiplexing/performance benefits for clients), placing per-connection memory limits, request timeouts, and connection-rate limits in front of ATS to bound how long a slow client can hold streams open, and rate-limiting or restricting untrusted client access to the proxy. These mitigations reduce but do not fully eliminate the resource-exhaustion window and may affect legitimate slow or high-latency clients.