Apache Traffic Server: 25 Vulnerabilities Disclosed Together on July 30, 2026
Key findings • 25 vulnerabilities disclosed for Apache Traffic Server on July 30, 2026. • Issues span memory corruption, DoS, access control bypasses, and request smuggling. • Multiple HT…
Key findings
- 25 vulnerabilities disclosed for Apache Traffic Server on July 30, 2026.
- Issues span memory corruption, DoS, access control bypasses, and request smuggling.
- Multiple HTTP/2 and HTTP/3 protocol handling flaws identified.
- Affected versions include 8.x, 9.x, and 10.x series.
- Recommended upgrade to versions 9.2.15 or 10.1.4.
On July 30, 2026, a significant batch of 25 vulnerabilities was disclosed for Apache Traffic Server, affecting multiple versions of the widely used caching proxy. These vulnerabilities span various components and introduce risks including memory corruption, denial-of-service, bypasses of access controls, and request smuggling. The disclosures highlight a broad range of weaknesses, underscoring the need for prompt updates to mitigate potential security threats.
Several vulnerabilities stem from improper handling of HTTP/2 and HTTP/3 protocols. CVE-2026-65100 details an issue where Traffic Server updates its HPACK dynamic table before confirming header block encoding, potentially corrupting subsequent headers. CVE-2026-58152 describes memory corruption due to mishandling integers during HPACK/XPACK header decoding. Furthermore, CVE-2026-58150 allows request smuggling by not rejecting Transfer-Encoding in HTTP/2 requests, while CVE-2026-58153 can lead to issues when converting HTTP/2 to HTTP/1 due to improper chunked framing of origin trailers. CVE-2026-65324 points to a denial-of-service vulnerability where the per-stream buffer cap is dropped when dechunking HTTP/2 or HTTP/3 responses, potentially exhausting server memory with slow clients.
Security issues related to access control and request manipulation are also prominent. CVE-2026-58156 details a port-based access control bypass due to mis-parsing of ports in URLs and userinfo. CVE-2026-58159 describes bypasses of IP access controls on UDS listeners and through ACL matching errors. CVE-2026-41920 involves improper access control, and CVE-2026-155 allows header aliasing, request smuggling, and policy bypass by truncating over-long header names. CVE-2026-57834 permits request smuggling when chunked messages are malformed. CVE-2026-58189 enables Server-Side Request Forgery (SSRF) amplification by allowing redirect-limit bypass when plugins reset the retry counter.
Memory corruption and stability issues are present across multiple CVEs. CVE-2026-58179 describes a stack and integer overflow in the regex_remap plugin. CVE-2026-58163 details state corruption or crashes due to mishandling on-disk cache fields and object lifetimes. CVE-2026-58160 involves out-of-bounds reads while parsing DNS answers. CVE-2026-58185 and CVE-2026-58164 highlight use-after-free errors, the latter specifically in remap configuration handling. CVE-2026-58161 notes crashes from null dereferences and dangling references in TLS and SNI handling. CVE-2026-58177 reports out-of-bounds writes, path traversal, and use-after-free errors within the Cripts framework. CVE-2026-58154 describes out-of-bounds writes or integer overflows when parsing MIME and HTTP headers. CVE-2026-58183 indicates that the prefetch plugin can crash when processing attacker-influenced input. CVE-2026-58178 details unbounded recursion and fetching of attacker-controlled URLs in the ESI plugin. CVE-2026-33267 is a general improper input validation vulnerability.
The affected versions span a wide range: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The recommended upgrade path for most of these issues is to version 9.2.15 or 10.1.4. Specific versions are mentioned for certain CVEs, such as CVE-2026-58177 requiring upgrade to 10.1.4, and CVE-2026-41920 requiring 9.1.15 or 10.1.4.
This coordinated disclosure of 25 vulnerabilities in Apache Traffic Server presents a critical update scenario for administrators. The breadth of issues, from protocol handling flaws to memory corruption and access control bypasses, necessitates immediate attention. Users are strongly advised to consult the official Apache Traffic Server advisories and upgrade to the patched versions to protect their infrastructure from potential exploitation.
The certifier plugin is also affected by CVE-2026-58162, which generates certificates based on attacker-controlled client SNI. Additionally, CVE-2026-65325 involves reusing multiplexed HTTP/2 origin connections without verifying the server certificate for the new request hostname. These issues, alongside the others disclosed on the same date, form a comprehensive security update for the product.
The vulnerabilities affect Apache Traffic Server versions from 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The recommended upgrade versions are 9.2.15 and 10.1.4, with specific notes for certain CVEs.
The disclosure of these 25 CVEs on July 30, 2026, highlights a critical need for Apache Traffic Server users to update their systems. The vulnerabilities cover a wide array of security risks, including memory corruption, denial-of-service, access control bypasses, and request smuggling, impacting multiple versions of the software. Promptly applying the recommended patches is essential for maintaining the security and integrity of services relying on Traffic Server.