EUVD-2026-50220
GHSA-wf7j-7jm8-xrmj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ATS proxy over network
-
DeliverySend crafted requests during remap processing
-
ExploitRace TOCTOU window in remap config handling
-
ExecutionAccess freed object (use-after-free)
-
PersistCrash worker or corrupt state
-
ImpactDenial of service on edge/CDN node
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets Apache Traffic Server's remap configuration handling (remap.config rule processing) and requires triggering the use-after-free / TOCTOU race - the CVSS 4.0 AT:P bit signals that a non-trivial attack requirement (winning the timing window between the check and the use, typically during concurrent remap processing or config reload) must be satisfied. No authentication is required (PR:N) and no user interaction (UI:N), and the affected versions are 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3. The principal limiting factor is the race condition itself: exploitation is probabilistic and depends on hitting the narrow timing window under favorable server-side concurrency, which makes a reliable single-shot exploit unlikely. |
| Impact | Signals are moderate-to-high but not maximal. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) shows network reachability with no privileges or user interaction, but the AT:P bit is decisive: a specific attack requirement - winning the TOCTOU race window - must be met, which reduces reliability of exploitation. Impact skews toward availability (VA:H) with only low confidentiality and integrity effects (VC:L/VI:L), consistent with a crash-primary use-after-free rather than reliable RCE. There is no KEV listing and no EPSS score supplied, and no POC referenced, so this reads as a real patch priority for edge/CDN operators due to DoS exposure, not a confirmed mass-exploitation event. Note the impact metrics do not claim code execution; treat RCE potential as unproven from the available data. |
| Exploit ScenarioDerived | An attacker with network reach to the proxy sends a stream of crafted requests timed to coincide with remap rule processing or a configuration reload, aiming to hit the check-then-use window and access memory freed by a concurrent operation. Success crashes the affected worker (denial of service) and may leak or corrupt small amounts of adjacent state; reliability is limited because the attacker must repeatedly race the timing window. No public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 29, 2026
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free and time-of-check/time-of-use race, primarily crashing the proxy (high availability impact) with secondary low-level confidentiality and integrity exposure. It affects the 8.x, 9.x, and 10.x branches up to 8.1.9, 9.2.14, and 10.1.3, and is fixed in 9.2.15 and 10.1.4. Reported by Apache with a CVSS 4.0 score of 8.3; no public exploit identified at time of analysis and it is not on CISA KEV.
Earlier versions of this analysis (2)
Memory corruption in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) stems from a use-after-free combined with a time-of-check/time-of-use race in the remap configuration handling path, which can be triggered remotely without authentication. Successful exploitation primarily threatens availability (proxy crash/denial of service) with secondary potential for limited information disclosure or memory-content leakage per the vendor's tagging. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.3 (High) reflects the unauthenticated network reach of this widely deployed caching proxy.
Use-after-free and time-of-check/time-of-use (TOCTOU) memory safety errors in Apache Traffic Server's remap configuration handling allow unauthenticated remote attackers to crash the proxy process, causing a denial of service. All three active release branches are affected - 8.x through 8.1.9, 9.x through 9.2.14, and 10.x through 10.1.3 - representing a broad installed base. No public exploit or CISA KEV listing is identified at time of analysis, but the network-accessible, zero-authentication attack surface combined with a high availability impact warrants prompt patching.
RemediationAI
Vendor-released patch: upgrade to 9.2.15 (for the 8.x and 9.x lines) or 10.1.4 (for the 10.x line), as directed in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. The 8.x branch has no dedicated fixed build in the advisory, so 8.x deployments must move to 9.2.15 or later, which may require validating remap and plugin compatibility across the major-version jump. No official workaround is published; as compensating controls, restrict who can trigger remap configuration reloads and minimize concurrent config churn, and place a hardened front-end proxy or WAF with rate limiting ahead of ATS to blunt attempts to force the race under load - with the trade-off that this does not eliminate the flaw and adds latency and operational complexity. Monitor traffic_server worker processes for crashes/restarts as a detection signal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Traffic Server (ATS) is a high-performance caching HTTP reverse/forward proxy used as CDN and edge infrastructure. The flaw resides in its remap subsystem, which maps inbound request URLs to upstream origins via remap.config rules. The root cause is CWE-416 (Use After Free) compounded by a TOCTOU race: an object referenced during remap processing can be freed and its memory reused, while a separate check-then-use window allows state to change between validation and access. Because remap handling occurs on the request path and can overlap with configuration reload/reprocessing, concurrent access to freed or mutated structures produces undefined behavior, most reliably a worker crash.
Know when Apache Traffic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but the TOCTOU race window makes exploitation high-complexity (AC:H); impact is availability-heavy with only low C/I from freed-memory access.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Executive ViewAI
Apache Traffic Server proxy deployments (versions 8 through 10.1.3) contain a memory corruption vulnerability that could cause service outages or expose sensitive data. Organizations relying on Traffic Server for request handling face potential business disruption and data security risks without immediate patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Apache Traffic Server
View allApache Traffic Server versions 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 ship an exp
Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and
Request smuggling in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be driven into a denial-of-service condition through log amplificat
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Exploit-DB