EUVD-2026-50233
GHSA-g2hg-96vq-xgmg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N and PR:N because the proxy is network-facing and unauthenticated, but AC:H reflects the required non-default experimental-plugin configuration (mapped from CVSS 4.0 AT:P).
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6DescriptionCVE.org
Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AnalysisAI
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Apache Traffic Server (ATS) is a high-performance, open-source forward and reverse proxy/caching server maintained by the Apache Software Foundation and commonly used as an edge caching and load-balancing layer. Beyond its core, ATS ships a collection of optional plugins, some marked 'experimental,' that extend request/response handling; this advisory concerns memory-safety and limit-bypass defects within several of those experimental plugins. The root cause maps to CWE-787 (Out-of-bounds Write), meaning attacker-influenced input causes the plugin to write past the bounds of an allocated buffer - the classic buffer-overflow / memory-corruption pattern also reflected in the tags. The single CPE provided (cpe:2.3:a:apache_software_foundation:apache_traffic_server) is version-agnostic and does not itself enumerate the affected experimental plugin modules.
RemediationAI
Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 8.x and 9.x branches) or 10.1.4 (for the 10.x branch), as stated in the Apache advisory (https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d); note that the 8.x branch has no dedicated fixed release listed, so 8.x users should migrate to 9.2.15 or later. As an immediate compensating control until patching, disable or unload the affected experimental plugins in remap.config/plugin.config and rebuild without them, accepting the trade-off of losing whatever functionality those plugins provided; if a specific experimental plugin is required, restrict which clients can reach the routes it processes at the network or ACL layer to shrink the attack surface. Because the fix branches are tagged releases, prefer the upgrade over long-term reliance on plugin removal.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today