EUVD-2026-50185
GHSA-r6wf-4rwv-gf97
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable URL parsing bypass requiring authenticated proxy access (PR:L) and specific URL crafting (AC:H); Changed scope (S:C) reflects proxy-to-backend boundary crossing with no availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AnalysisAI
Port-based access-control bypass in Apache Traffic Server stems from URL and userinfo mis-parsing that causes the proxy to evaluate ACL rules against an incorrect port value, allowing restricted backend ports to be reached. All three maintained release branches are affected - 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 - meaning the majority of deployed ATS instances are vulnerable. No public exploit or active exploitation has been identified at time of analysis, but the Changed scope (S:C) in the CVSS vector signals that successful exploitation crosses the proxy-to-backend boundary, amplifying real-world impact beyond the ATS process itself.
Technical ContextAI
Apache Traffic Server is a high-performance, enterprise-grade HTTP/1.1 and HTTP/2 reverse proxy and caching server commonly used in CDN and large-scale web infrastructure. The vulnerability (CWE-863: Incorrect Authorization) is rooted in ATS mis-parsing the port field in both standard URL authority syntax (host:port) and the userinfo sub-component (user:password@host:port). This parsing inconsistency causes the authorization engine to evaluate port-based ACL rules against a different port than the one actually targeted, producing an incorrect allow/deny decision. CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server:*:*:*:*:*:*:*:* confirms the issue is in the Apache Software Foundation ATS product itself, not a third-party dependency.
RemediationAI
Upgrade to Apache Traffic Server 9.2.15 or 10.1.4, the vendor-confirmed fixed releases per the advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Operators on branch 8.x (8.0.0-8.1.9) should migrate to a supported branch since no 8.x patch is listed - remaining on 8.x leaves the vulnerability unaddressed. Where immediate patching is not feasible, the most actionable compensating control is to enforce port restrictions at the network layer (e.g., firewall rules or iptables on the ATS host) rather than relying solely on ATS ACL rules, accepting the trade-off of managing two separate rule sets. Administrators should also audit existing port-based ACL configurations to identify which backend ports are intended to be blocked, since those are the specific assets at risk. Removing or replacing userinfo-based routing logic in ATS configurations can further reduce the attack surface while the patch is staged.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today