Which versions of Apache Traffic Server are affected by EUVD-2026-50211?

Apache Traffic Server proxy infrastructure (versions 8.x, 9.x, and 10.x) is vulnerable to remote denial-of-service attacks through malformed PROXY protocol input, risking service unavailability for…

How to fix or mitigate EUVD-2026-50211?

Within 24 hours: Audit all Apache Traffic Server deployments to identify instances running versions 8.0.0-8.1.9, 9.0.0-9.2.14, or 10.0.0-10.1.3 and verify whether PROXY protocol is enabled; disable PROXY protocol immediately if operationally feasible. Within 7 days: For deployments where PROXY protocol is required, restrict network access to PROXY protocol listening ports to trusted upstream systems and load balancers via firewall or cloud security group rules, and implement connection rate limiting on proxy services to degrade exploit effectiveness. Within 30 days: Monitor Apache Traffic Server security advisories for patched releases (expected versions 9.2.15, 10.1.4, or later); stage and test patches in a non-production environment, then plan and execute production deployment with change management approval.

Apache Traffic Server EUVD-2026-50211

Q: What is the CVSS score of EUVD-2026-50211?

EUVD-2026-50211 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-58158 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-29 apache

GHSA-99g5-7fmc-568c

Buffer Overflow Apache Stack Overflow Apache Traffic Server Apache Software Foundation

8.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.2 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-reachable and unauthenticated, but AC:H because the non-default PROXY-protocol feature must be enabled; impact is availability-only (crash), so C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:52 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 29, 2026 - 10:52 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

5.9 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Jul 29, 2026 - 10:00 vuln.today

CVE Published

Jul 29, 2026 - 08:26 cve.org

MEDIUM 5.9

DescriptionCVE.org

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Denial-of-service (and potential memory-corruption) in Apache Traffic Server arises from mishandling of PROXY protocol input, where malformed port fields are truncated and cause a stack buffer overflow (CWE-121). Affected releases span the 8.x, 9.x, and 10.x branches (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), and remote attackers can crash the proxy when it is configured to accept PROXY protocol connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor scores the impact as availability-only (CVSS 4.0 base 8.2).

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance forward/reverse caching HTTP proxy commonly deployed at the edge of CDN and load-balanced infrastructures. The PROXY protocol (originating with HAProxy) is a small header prepended to a TCP connection so that a downstream proxy like ATS can recover the real client IP and port when it sits behind another L4/L7 balancer. The flaw is CWE-121 (stack-based buffer overflow): while parsing the PROXY header, ATS truncates the port value and writes beyond a fixed-size stack buffer. The single CPE published (cpe:2.3:a:apache_software_foundation:apache_traffic_server:*) covers all affected branches, and the tags (Buffer Overflow, Stack Overflow) corroborate the root cause. Because the parsing occurs before normal request handling, the overflow is reachable on any listener where PROXY protocol acceptance has been enabled.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 8.x and 9.x branches) or 10.1.4 (for the 10.x branch) per the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d; 8.x is EOL and has no in-branch fix, so 8.x operators should move to 9.2.15 or later. As a compensating control until patching, disable or tightly scope PROXY protocol acceptance on inbound listeners (e.g. remove the accept-proxy/PROXY-protocol setting from proxy.config on affected ports, or clear the proxy protocol allowlist) - the trade-off is that ATS will then log the upstream balancer's IP instead of the real client IP, breaking client-IP-based ACLs, logging, and rate limiting. Alternatively, restrict the ports that speak PROXY protocol so they are reachable only from trusted upstream load balancers via network ACLs/firewalling, which preserves client-IP recovery but requires that the upstream path itself be trusted and non-spoofable.