EUVD-2026-50213
GHSA-rx45-8hxf-g37v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via DNS response channel requiring no authentication; out-of-bounds read yields partial confidentiality and availability impact but no write capability or integrity impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Apache Traffic Server reads out of bounds while parsing DNS answers.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AnalysisAI
Out-of-bounds read in Apache Traffic Server's DNS answer parser (CWE-125) allows unauthenticated remote attackers - or adversaries capable of influencing DNS responses - to leak partial heap memory contents or crash the ATS process, affecting all three active release branches (8.x, 9.x, 10.x). The CVSS 6.5 Medium rating reflects no authentication barrier and no user interaction required, though impact is limited to partial confidentiality and availability loss with no integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis, but the network attack surface is broad given that every proxied request triggers DNS resolution.
Technical ContextAI
Apache Traffic Server (ATS) is a high-performance HTTP/HTTPS reverse and forward proxy widely used in CDN and enterprise environments. When resolving origin server hostnames, ATS parses DNS answers received from configured resolvers. The vulnerability (CWE-125: Out-of-bounds Read) resides in this DNS answer parsing logic, where the parser reads beyond the allocated buffer boundary when processing crafted or malformed DNS response data. The CPE string cpe:2.3:a:apache_software_foundation:apache_traffic_server confirms the flaw is in the core ATS application across all three active release trains. An out-of-bounds read in heap-allocated DNS response buffers can expose adjacent memory contents - potentially including request metadata, credentials in flight, or internal pointers - or trigger a segmentation fault causing process termination and traffic disruption.
RemediationAI
The primary fix is to upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, as explicitly recommended by the Apache Software Foundation in their advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Users running the 8.x branch should migrate to 9.2.15 or 10.1.4, as no 8.x patch version is identified in the advisory. If immediate upgrade is not feasible, a targeted compensating control is to restrict ATS to only query explicitly trusted, internal DNS resolvers (e.g., on-premises DNS servers under your control), applied via ATS proxy.config.dns.nameservers and network-layer firewall rules blocking ATS from reaching external resolvers - this reduces an attacker's ability to inject malformed DNS answers but does not eliminate the underlying vulnerability and may break forward-proxy configurations that require external DNS resolution. Logging and monitoring of ATS process crashes can help detect exploitation attempts while a patch window is arranged.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today