Apache Traffic Server EUVD-2026-50226

Exploitation requires that the target Apache Traffic Server instance has the uri_signing plugin or the url_sig plugin loaded and enabled on a reachable route - this is the exact precondition reflected by the CVSS 4.0 AT:P metric, and installations without either plugin are not exploitable. Given the affected versions (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), a vulnerable-version node with signing enabled can be attacked remotely and unauthenticated (PR:N, UI:N) simply by reaching the signing-protected endpoint with crafted URI/token input. The limiting factors are therefore configuration-based rather than access-based: the plugin must be in use, and the endpoint must be routable to the attacker; there is no authentication, user-interaction, or platform-specific requirement beyond that. Impact is limited to availability (VA:H) - the process crashes or exhausts its stack - with no confidentiality or integrity effect.

The signals are consistent and point to a moderate-to-high but availability-scoped risk. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VA:H, VC:N/VI:N) shows remote, low-complexity, unauthenticated reach with high availability impact but zero confidentiality/integrity impact - this is a crash/DoS, not code execution, despite the buffer-overflow class. The AT:P (attack requirements present) metric aligns with the real-world precondition that the uri_signing or url_sig plugin must be configured and enabled, which meaningfully narrows the exposed population. No EPSS score, KEV listing, SSVC decision, or POC was provided: exploitation status is 'no public exploit identified at time of analysis,' so this is not currently evidence of active exploitation. Priority should be driven by whether an organization actually runs these signing plugins at internet-facing edges; for those that do, an unauthenticated remote crash of CDN nodes is a genuine operational concern, while installations without the plugins are effectively unaffected. Note the mismatch worth verifying: the CWE-121 stack-overflow classification could in theory imply memory corruption, but the vendor CVSS explicitly rates integrity/confidentiality as None and only availability as High - treat this as a DoS unless the vendor advisory states otherwise.

An attacker identifies an internet-facing Traffic Server edge node that fronts protected content using signed URLs, then sends a crafted request whose token/URI field is shaped to drive the uri_signing or url_sig parser into deep recursion or an oversized stack copy. With AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed, so a single malformed request - or a small stream of them - repeatedly crashes the proxy and denies service to legitimate users. No public exploit code has been identified at time of analysis.