Apache Traffic Server EUVD-2026-50228

Exploitation requires that the target Apache Traffic Server has the prefetch plugin loaded and processing requests - this is the concrete prerequisite reflected by the CVSS 4.0 AT:P (attack requirements present) metric and the description's explicit reference to the prefetch plugin. Given AV:N/PR:N/UI:N, no authentication and no user interaction are otherwise needed once the plugin is active, only network reachability. The primary limiting factor is that prefetch is an optional, non-default plugin: ATS instances that do not load it are not exposed. Affected versions are 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3.

The signals are largely consistent and point to a real but availability-only risk. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) indicates a remote, unauthenticated, low-complexity attack that carries a specific attack requirement (AT:P) and impacts only availability at high severity, yielding the 8.2 score. The AT:P metric together with the description implies the prefetch plugin must be enabled and reachable, which meaningfully narrows the exposed population below what the raw score suggests. No EPSS value was provided, the flaw is not in CISA KEV, and no POC is referenced, so there is no evidence of active or imminent exploitation. Net: prioritize for internet-facing ATS deployments that load the prefetch plugin, but treat non-prefetch deployments as effectively not exposed.

An attacker sends crafted requests to an internet-facing Apache Traffic Server instance that has the prefetch plugin enabled, supplying malformed input the plugin fails to validate. The plugin crashes the ATS process, dropping in-flight connections and denying cache/proxy service to legitimate users. No authentication or user interaction is required, and the low attack complexity makes repeated crashing feasible, though the prefetch plugin must be in use to reach the vulnerable code.