Apache Traffic Server EUVD-2026-50229

Exploitation requires that the target Apache Traffic Server has the header_rewrite plugin loaded AND configured with either cookie operations or CIDR condition matching - this is the concrete prerequisite encoded by the CVSS 4.0 AT:P (Attack Requirement Present) bit and stated in the description. Given AV:N/AC:L/PR:N/UI:N, once such a ruleset is deployed the flaw is reachable by remote, unauthenticated attackers with no user interaction by sending requests that exercise the cookie or CIDR logic. The main limiting factor is configuration-dependence: ATS instances that do not use header_rewrite, or that use it without cookie/CIDR rules, are not exploitable; affected versions are limited to 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3.

The vendor CVSS 4.0 score is 8.3 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H - network-reachable, unauthenticated, low complexity, but with an explicit Attack Requirement (AT:P) and impact dominated by availability. The AT:P bit and the description are the key nuance: exploitation is only possible when the header_rewrite plugin is actually loaded AND configured with cookie operations or CIDR conditions, so this is not a blanket 'any ATS is exploitable' issue. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or public exploit code - the risk is currently theoretical-but-serious rather than urgent-in-the-wild. Real priority is high for deployments that use header_rewrite with those features (edge/CDN operators commonly do); for deployments without the plugin or without cookie/CIDR rules, real-world risk is low despite the high base score. The VC:L suggests possible limited memory disclosure, but the dominant, confirmed impact is a remotely triggerable crash (DoS) of the proxy.

An attacker sends crafted HTTP requests with malformed or oversized Cookie headers (or from source IPs designed to exercise CIDR matching) to an ATS instance whose header_rewrite ruleset performs cookie operations or CIDR condition checks, driving the plugin to write out of bounds and crash the proxy, causing a denial of service for all traffic behind it. Because the vector is network and unauthenticated (PR:N/UI:N), repeated requests can keep the edge tier offline. No public POC is currently identified, so this scenario is inferred from the CVSS vector and CWE-787 description.