EUVD-2026-50207
GHSA-4c56-c2ph-pp8x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N because ATS is network-facing; AC:H for required connection coalescing precondition; C:L/I:L for partial traffic misdirection with no availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AnalysisAI
Improper TLS certificate validation in Apache Traffic Server (ATS) versions 9.0.0-9.2.14 and 10.0.0-10.1.3 allows multiplexed HTTP/2 origin connections to be reused for requests targeting hostnames not covered by the existing connection's server certificate. When ATS coalesces HTTP/2 connections to origin servers, it omits the check confirming the server certificate's Subject Alternative Names cover the new request's hostname, meaning traffic may be silently routed over a connection authenticated for a different host. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.2.15 and 10.1.4.
Technical ContextAI
Apache Traffic Server is a high-performance HTTP/1.1 and HTTP/2 caching and forward/reverse proxy, catalogued under CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server:*:*:*:*:*:*:*:*. The vulnerability arises in ATS's HTTP/2 connection coalescing logic: RFC 7540 permits multiplexing multiple requests over a single TCP+TLS connection to an origin if that connection is already established to the same IP address and port and the server certificate covers the target hostname. ATS skips the latter check, violating the RFC's precondition. The root cause is classified as CWE-295 (Improper Certificate Validation) - a structural trust failure rather than a cryptographic weakness. An attacker who can induce ATS to coalesce a connection to an origin they influence (e.g., two hostnames resolving to the same IP, or via a crafted upstream environment) can cause ATS to send requests intended for Host A over a TLS session authenticated only for Host B, bypassing hostname binding that TLS is intended to enforce.
RemediationAI
The primary fix is to upgrade Apache Traffic Server to version 9.2.15 (for the 9.x branch) or 10.1.4 (for the 10.x branch), both of which enforce certificate hostname validation before reusing multiplexed HTTP/2 connections to origin servers, per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. If an immediate upgrade is not possible, a targeted workaround is to disable HTTP/2 on origin-facing (upstream) connections in ATS configuration, which prevents connection coalescing entirely and eliminates the vulnerable code path - the trade-off is loss of HTTP/2 multiplexing efficiency to origins, which may increase connection overhead and latency under high concurrency. Restricting ATS's upstream routing to environments where origin IP addresses are not shared across different hostnames (i.e., no IP-based connection reuse opportunity exists) also reduces the attack surface but requires infrastructure-level controls and is difficult to enforce reliably.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today