EUVD-2026-50171
GHSA-4p58-9v5g-254v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ATS proxy over network
-
DeliverySend request with over-long Host header
-
ExploitRedirect handling copies header to stack buffer
-
ExecutionOverflow fixed-size stack buffer
-
ImpactCrash Traffic Server process (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that Apache Traffic Server's redirect-following feature is enabled - this is the specific configuration prerequisite (AT:P in the CVSS vector); against a default deployment without redirect following, the vulnerable code path is not reached. When that condition is met, no authentication or user interaction is needed (PR:N/UI:N) and the attack is over the network (AV:N): the attacker simply supplies an over-long client Host header. The limiting factor is therefore purely the non-default redirect-following configuration, plus running an affected version (8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3). |
| Impact | The signals are moderately consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) yields 8.2 (High): network-reachable, unauthenticated, low complexity, but with an Attack Requirement (AT:P) - namely that redirect following must be enabled - and impact scoped to availability only (VA:H), meaning the vendor characterizes this primarily as a crash/DoS rather than confirmed code execution. This is not in CISA KEV and no POC is referenced, so exploitation is theoretical at present. Note a tension worth flagging: a stack buffer overflow (CWE-121) can in principle lead to code execution, yet the vendor set VC:N/VI:N and only VA:H, so any RCE claim would go beyond the assessed data - treat this as a DoS-priority issue unless the vendor advisory states otherwise. Because exploitation is gated on the non-default redirect-following configuration, real-world exposure is narrower than the raw 8.2 suggests. No EPSS score was provided in the input. |
| Exploit ScenarioDerived | With redirect following enabled, a remote unauthenticated attacker sends an HTTP request carrying an abnormally long Host header to the ATS proxy; during redirect handling the header is copied into an undersized stack buffer, corrupting the stack and crashing the server process, causing denial of service to all clients behind that node. No public exploit code is currently identified, and low attack complexity means the crash is straightforward to trigger once the required configuration is present. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 29, 2026
Denial-of-service (and potential memory corruption) in Apache Traffic Server affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 when redirect following is enabled. The proxy copies the client-supplied Host header into a fixed-size stack buffer without bounds checking during redirect handling, so an over-long Host header overflows the stack and crashes the process. There is no public exploit identified at time of analysis, and the vendor-assessed impact is limited to availability (CVSS 4.0 base 8.2).
Earlier versions of this analysis (1)
Stack-based buffer overflow in Apache Traffic Server's redirect-handling code path allows remote unauthenticated attackers to crash the proxy by supplying an over-long Host header, resulting in denial of service. Affected deployments span three supported branches - 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 - but only when redirect following is explicitly enabled in the ATS configuration. No public exploit or confirmed active exploitation has been identified at time of analysis; primary risk is targeted availability disruption against misconfigured deployments.
RemediationAI
Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 9.x line) or 10.1.4 (for the 10.x line), per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Operators on the 8.0.0-8.1.9 line have no patched version identified in the available data and should plan migration to a fixed 9.2.15+ or 10.1.4+ release. As an immediate compensating control where patching is not possible, disable the redirect-following feature (e.g., proxy.config.http.redirect.actions / number_of_redirections and related redirect settings), since the vulnerable code path is only reached when redirect following is enabled - the trade-off is that ATS will no longer transparently chase origin 3xx redirects, which may break workflows that rely on that behavior. Additionally, enforcing a strict maximum Host/request-header length at an upstream WAF or load balancer can blunt over-long Host headers before they reach ATS.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Traffic Server (ATS) is a high-performance caching HTTP forward and reverse proxy widely used in CDN and edge-cache deployments. This flaw is a classic CWE-121 Stack-based Buffer Overflow: during ATS's redirect-following logic, the incoming client Host header is copied into a fixed-size buffer allocated on the stack without validating that the header length fits, allowing adjacent stack memory (including saved registers and return addresses) to be overwritten. The affected code path is only reached when the redirect-following feature (which lets ATS itself chase HTTP 3xx redirects from origins) is active, per the CPE entry cpe:2.3:a:apache_software_foundation:apache_traffic_server:*.
Know when Apache Traffic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network and unauthenticated (AV:N/PR:N), but AC:H reflects the required non-default redirect-following configuration (AT:P); impact is availability-only DoS per vendor, so C:N/I:N/A:H.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Executive ViewAI
Apache Traffic Server versions 8.0-10.1 contain a stack buffer overflow vulnerability triggered by oversized Host headers during redirect processing, causing denial of service. Organizations running affected versions without mitigation face service disruptions to critical web proxy infrastructure. No vendor patch is currently available, requiring immediate interim controls.
Disable HTTP redirect following in Apache Traffic Server configuration settings, or deploy upstream HTTP request validation to restrict Host header sizes to acceptable lengths. Both controls eliminate the attack surface until patches are available from the vendor.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Apache Traffic Server
View allApache Traffic Server versions 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 ship an exp
Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and
Request smuggling in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be driven into a denial-of-service condition through log amplificat
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Exploit-DB