Apache Traffic Server EUVD-2026-50207

Exploitation requires that ATS has an active, multiplexed HTTP/2 connection to an origin server whose IP address is also associated with a different target hostname in the same proxy environment - specifically, the connection coalescing optimization must be triggered, meaning both hostnames must resolve to the same origin IP and port. This is most likely in multi-tenant CDN, shared hosting, or forward-proxy deployments where multiple backends share infrastructure. The CVSS PR:N indicates no authentication to ATS itself is required; however, the attacker must be able to influence either DNS resolution of origin hostnames or operate one of the shared-IP origin endpoints. Exploitation is limited by AC:H conditions: a single-tenant reverse proxy with unique-IP origins is not reachable via this vector. No user interaction is required (UI:N), and the vulnerability is not triggered by default configurations in isolated deployments.

The CVSS 3.1 score of 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N accurately captures the constrained exploitability: AC:H reflects that connection coalescing must already be active and the attacker must control or influence a hostname sharing an origin IP with the target, a non-trivial prerequisite. C:L and I:L acknowledge that the impact is partial - responses from an unintended origin may expose data or corrupt integrity, but scope is unchanged (S:U) meaning there is no privilege escalation or lateral movement. No EPSS data was provided in the input; no KEV listing confirms active exploitation; no public POC has been identified. This is a real correctness and security flaw in TLS hostname verification but is realistically constrained to scenarios involving shared infrastructure, multi-tenant CDN environments, or adversarially crafted upstream topologies. Organizations operating ATS as a forward proxy in environments where origin IP addresses are shared across tenants or where DNS is attacker-influenced face elevated risk. For a typical single-tenant reverse proxy deployment, the practical exploitability is low.

An attacker operating or influencing two origin hostnames (e.g., attacker-controlled.example and target.example) that resolve to the same IP address sends requests through a vulnerable ATS instance. Because an existing HTTP/2 connection to that IP is already open and ATS skips certificate hostname validation before coalescing, ATS routes the request for target.example over the TLS session established for attacker-controlled.example. The attacker's origin server receives the proxied request intended for the target, potentially exposing sensitive request content such as headers, cookies, or POST bodies. No public POC has been identified at time of analysis.