EUVD-2026-50235
GHSA-c6fq-3mhw-8g4j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible HTTP/2 endpoint requires no auth, but encode failure triggering demands specific conditions (AC:H); only connection-scoped integrity and availability are impacted.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AnalysisAI
HTTP/2 HPACK dynamic table desynchronization in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) exposes a premature-state-update flaw in header compression logic. An unauthenticated remote attacker can trigger an HPACK encode failure, leaving the server's encoder table out of sync with the peer decoder's table and corrupting all subsequent header blocks transmitted on that HTTP/2 connection. No public exploit has been identified at time of analysis; the AC:H rating indicates reliable triggering requires specific conditions, and CISA KEV does not list this vulnerability.
Technical ContextAI
Apache Traffic Server (ATS) implements HTTP/2 using HPACK header compression as defined in RFC 7541. HPACK relies on synchronized dynamic tables maintained independently by both the encoder (server) and decoder (peer); both sides must reflect identical state after each header block exchange. CWE-696 (Incorrect Behavior Order) identifies the root cause: ATS updates its local dynamic table before confirming that the header block encoding operation completed successfully. When an encode failure occurs mid-operation, the table has already been mutated on the server side while the peer's decoder table remains in its prior state. This divergence is permanent for the lifetime of the connection - every subsequent HPACK-encoded header block the server sends will be interpreted incorrectly by the peer, as it will attempt to resolve index references against a different table state. The CPE string cpe:2.3:a:apache_software_foundation:apache_traffic_server:*:*:*:*:*:*:*:* confirms this is a defect in the ATS application itself, not an underlying OS or runtime library.
RemediationAI
The primary remediation is to upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, both of which contain the vendor-confirmed fix. The Apache advisory at https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d provides authoritative guidance. For deployments on the 8.x branch, no fix version is listed - operators should migrate to a supported branch (9.2.15 or 10.1.4) as 8.x appears to be outside the patched range. If an immediate upgrade is not feasible, disabling HTTP/2 support in ATS eliminates the vulnerable code path entirely (since HPACK is exclusive to HTTP/2); the trade-off is reduced throughput and header compression efficiency for HTTP/2-capable clients, which would fall back to HTTP/1.1. No other configuration-level workaround is apparent given the flaw resides in the internal HPACK encode pipeline rather than an externally toggleable feature.
More in Apache Traffic Server
View allRemote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated atta
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers c
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) ari
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated atta
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) all
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows rem
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-b
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers t
Same weakness CWE-696 – Incorrect Behavior Order
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today