Which versions of Apache Traffic Server are affected by EUVD-2026-50169?

Apache Traffic Server versions 9.2.0-9.2.14 and 10.1.0-10.1.3 contain an input validation vulnerability allowing remote attackers to manipulate traffic integrity through the proxy, potentially…

How to fix or mitigate EUVD-2026-50169?

Within 24 hours, conduct a complete inventory of all Apache Traffic Server instances running the affected versions (9.2.0-9.2.14 and 10.1.0-10.1.3) and document their production criticality. Within 7 days, implement compensating controls including input validation filters at proxy ingress points, enable traffic integrity verification mechanisms, deploy monitoring for malformed input detection, and establish direct communication with the Apache Traffic Server project for patch timeline. Within 30 days, develop and test an upgrade strategy for patched versions once available; evaluate temporary network segmentation to limit proxy exposure if production deployment is critical.

Apache Traffic Server EUVD-2026-50169

Q: What is the CVSS score of EUVD-2026-50169?

EUVD-2026-50169 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-33267 HIGH

Improper Input Validation (CWE-20)

2026-07-29 apache

GHSA-jrh6-9hgv-mqm7

Apache Information Disclosure Apache Traffic Server Apache Software Foundation

7.7

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Network-reachable, low-complexity, unauthenticated with no UI; impact is integrity of a separate downstream system (scope change S:C, I:H), with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 08:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Jul 29, 2026 - 08:22 NVD

10.0 (HIGH) 7.7 (HIGH)

Analysis Generated

Jul 29, 2026 - 08:16 vuln.today

CVE Published

Jul 29, 2026 - 07:21 cve.org

HIGH 10.0

DescriptionCVE.org

Improper Input Validation vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

AnalysisAI

Improper input validation in Apache Traffic Server versions 9.2.0-9.2.14 and 10.1.0-10.1.3 lets remote attackers send malformed input that the proxy fails to validate, allowing manipulation of the integrity of downstream/backend traffic (e.g. request smuggling or response manipulation against systems behind the proxy). The CVSS 4.0 score is 7.7 (High), driven entirely by subsequent-system integrity impact (SI:H) with no confidentiality or availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance, layer-7 caching HTTP/HTTPS forward and reverse proxy widely used in CDN and edge-caching deployments. The root cause is CWE-20 (Improper Input Validation): ATS accepts and forwards input that it does not adequately sanitize or normalize before acting on it or relaying it upstream/downstream. In proxy software this class of flaw typically manifests as HTTP request/response parsing discrepancies - for example inconsistent handling of headers, message framing, or encoding - that let a client desynchronize how the proxy and a backend interpret a request boundary. The CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server covers all affected builds; the vendor-reported tags reference 'Information Disclosure', though the official CVSS 4.0 vector records confidentiality as N and integrity of the subsequent system as H, so the primary documented impact is integrity, not disclosure.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.2.x branch) or 10.1.4 (for the 10.1.x branch), per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. The upgrade is the primary and recommended fix. No official standalone workaround was published in the provided data; where immediate patching is not possible, reduce exposure by fronting ATS with a strict upstream reverse proxy or WAF that normalizes and rejects ambiguous HTTP framing (conflicting Content-Length/Transfer-Encoding, malformed headers), and restrict which clients can reach the proxy where feasible - with the trade-off that a WAF only mitigates request-smuggling-style vectors and may not cover all improper-input paths, so it is a stopgap rather than a substitute for the fix.