EUVD-2026-50224
GHSA-xwr4-7vg8-hx5g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via crafted HTTP requests (AV:N), but regex_remap must be configured with substitution rules (AC:H); no auth or interaction required; full stack corruption impact warrants C:H/I:H/A:H.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
4DescriptionCVE.org
The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AnalysisAI
Stack-based buffer overflow and integer overflow in Apache Traffic Server's regex_remap plugin expose production proxy deployments to high-impact compromise via crafted substitution input. Versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are all affected, with confidentiality, integrity, and availability fully at risk. No public exploit identified at time of analysis, though the network-exploitable nature and full-triad impact make patching urgent for any deployment relying on regex_remap for URL rewriting.
Technical ContextAI
Apache Traffic Server (ATS) is a high-performance HTTP proxy and cache used by CDN operators and large-scale web infrastructure. The regex_remap plugin - identified via CPE cpe:2.3:a:apache_software_foundation:apache_traffic_server - provides regular-expression-based URL remapping and rewriting. CWE-121 (Stack-based Buffer Overflow) identifies the root cause class: the plugin processes substitution input without adequate bounds checking, causing both integer overflows (likely during length calculations) and a resultant stack-based overflow when the computed buffer size is incorrect. This class of vulnerability is consistent with regex backreference substitution logic where group capture lengths are computed as integers before being written to a fixed-size stack buffer.
RemediationAI
The primary fix is to upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 as recommended by the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Users on the 8.x branch must migrate to a supported release (9.2.15 or 10.1.4), as no patch has been issued for 8.0.0-8.1.9. If immediate upgrade is not feasible, the most targeted compensating control is to disable the regex_remap plugin entirely by removing it from plugin.config and reloading ATS configuration, then using an alternative remap method (e.g., the built-in remap.config without regex substitution); however, this trade-off may break existing URL rewriting rules and require remap reconfiguration. Restricting inbound HTTP requests to trusted sources via upstream ACLs or firewall rules reduces the attack surface but does not eliminate the vulnerability for internet-facing deployments. Confirm the plugin is present with 'traffic_server -R 1' or by inspecting plugin.config before assuming exposure.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today