Apache Traffic Server EUVD-2026-50222

Exploitation requires the target to be running Apache Traffic Server 10.0.0 through 10.1.3 with the Cripts scripting framework in use in its configuration - the vulnerable code lives in Cripts, so deployments not using Cripts request/response handling are unlikely to be exposed (this is the concrete attack requirement reflected by AT:P in the CVSS 4.0 vector). No authentication and no user interaction are required (PR:N/UI:N), and the attack is delivered over the network (AV:N) with low complexity (AC:L). The main limiting factors are that the affected ATS instance must be network-reachable by the attacker and must exercise the vulnerable Cripts paths; the confirmed impact is weighted toward denial of service (VA:H) with only limited integrity effect (VI:L) and no confidentiality impact, so this is not a confirmed data-exfiltration or full-compromise condition.

The signals are moderately elevated but not maximal. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) shows a network-reachable, low-complexity, unauthenticated attack, but the AT:P flag means a specific attack requirement must hold in the target environment - most plausibly that the deployment actually uses the Cripts framework, which is not guaranteed for every ATS install. Impact is weighted toward availability (VA:H) with only low integrity (VI:L) and no confidentiality impact (VC:N), consistent with memory-corruption-induced crashes rather than confirmed remote code execution. No EPSS score, SSVC decision, KEV listing, or public POC was provided, so real-world exploitation pressure appears low at present. The realistic priority is: patch promptly if you run Cripts-based configurations on internet-facing ATS, but this is not a confirmed mass-exploited RCE. Note the tension between the memory-corruption bug classes (which theoretically could enable code execution) and the CVSS impact rating capping integrity at Low and confidentiality at None - the vendor scoring implies DoS is the primary realistic outcome; treat any RCE speculation as unconfirmed.

An attacker who can reach an internet-facing Apache Traffic Server (10.0.0-10.1.3) that uses the Cripts framework sends a crafted HTTP request designed to drive the vulnerable Cripts code paths into an out-of-bounds write or use-after-free, crashing the proxy worker and interrupting service, and potentially traversing paths to reach unintended files. Because the vector is network-based and requires no authentication or user interaction (AV:N/PR:N/UI:N), the request can be delivered directly, though success depends on the target actually running affected Cripts logic (AT:P). No public exploit code has been identified at time of analysis.