Which versions of Apache Traffic Server are affected by EUVD-2026-50234?

Apache Traffic Server versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 contain a request amplification vulnerability that could enable attackers to overwhelm affected proxies and degrade service…

How to fix or mitigate EUVD-2026-50234?

Within 24 hours, audit your environment to identify all Apache Traffic Server deployments and pinpoint affected versions across the 8.x, 9.x, and 10.x product lines. Within 7 days, review active plugins that may reset the internal retry counter and apply compensating controls: implement rate limiting on outbound proxy requests, enforce strict connection limits per upstream target, and consider disabling non-critical plugins until patched versions are available. Within 30 days, establish a monitoring baseline for request amplification patterns, monitor upstream Apache Traffic Server release notes for patched versions (expected in 8.1.10+, 9.2.15+, or 10.1.4+), and develop a staged upgrade plan to transition production traffic to patched releases with full testing in pre-production environments.

Apache Traffic Server EUVD-2026-50234

Q: What is the CVSS score of EUVD-2026-50234?

EUVD-2026-50234 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-58189 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-29 apache

GHSA-f54r-392m-jmr7

Apache SSRF Apache Traffic Server Apache Software Foundation

8.2

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

8.2 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-reachable and unauthenticated, but the required counter-resetting plugin raises AC:H; amplification affects backend availability (S:C, A:H) with no confidentiality or integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 29, 2026 - 10:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 29, 2026 - 10:22 vuln.today

cvss_changed

Severity Changed

Jul 29, 2026 - 10:22 NVD

MEDIUM HIGH

CVSS changed

Jul 29, 2026 - 10:22 NVD

7.5 (MEDIUM) 8.2 (HIGH)

Analysis Generated

Jul 29, 2026 - 09:51 vuln.today

CVE Published

Jul 29, 2026 - 09:05 cve.org

MEDIUM 7.5

DescriptionCVE.org

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

AnalysisAI

Server-Side Request Forgery amplification in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to bypass the configured redirect-follow limit when a plugin resets the internal retry counter, letting a single request fan out into a large chain of proxy-originated requests. The CVSS 4.0 base score is 8.2 (High), reflecting high impact on availability rather than data disclosure, with an attack requirement (AT:P) tied to specific plugin behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Apache Traffic Server (ATS) is a high-performance, open-source forward and reverse HTTP caching proxy widely used at the edge of CDNs and large web infrastructures. The flaw is classified as CWE-918 (Server-Side Request Forgery): ATS follows HTTP redirects on behalf of clients and enforces a maximum redirect count to prevent runaway request chains, but that safeguard is defeated when a plugin resets the retry/redirect counter mid-processing. Because the counter no longer monotonically bounds the number of followed redirects, ATS can be coerced into issuing an unbounded or greatly multiplied set of outbound requests. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_traffic_server, and the amplification behavior is the mechanism converting a single inbound request into many proxy-originated outbound requests.

RemediationAI

Vendor-released patch: upgrade to Apache Traffic Server 9.2.15 (for the 8.x and 9.x lines) or 10.1.4 (for the 10.x line), as directed in the Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d. Because exploitation requires a plugin that resets the redirect/retry counter, an immediate compensating control where patching must be deferred is to audit and disable any custom or third-party plugins that manipulate redirect retry handling, and to disable proxy redirect-following (do not follow upstream 3xx redirects on behalf of clients) if your deployment does not require it - the trade-off is that legitimate redirect-following behavior for backends and clients will break. Additionally, rate-limit outbound proxy requests and restrict which upstream/backend destinations ATS may reach so that any amplified request chain is bounded and cannot be aimed at internal infrastructure; the side effect is added configuration overhead and potential blocking of legitimate but unlisted upstreams.