Executive brief
Apache Traffic Server, a high-performance caching proxy used to manage web traffic and speed up content delivery, contains a security flaw in how it processes web requests. An attacker could exploit this vulnerability to bypass security rules or access sensitive data by sending specially crafted requests that trick the server's pattern-matching logic. Organizations should update to the latest versions to ensure their traffic filtering and data protection remains effective.
Technical details
Apache Traffic Server is vulnerable to CWE-777 (Regular Expression without Anchors). The vulnerability exists because certain internal regular expressions used for request processing or filtering do not use start (^) or end ($) anchors, allowing them to match unintended substrings within a URI or header. A remote, unauthenticated attacker can exploit this by crafting malicious network requests that satisfy the loose regex criteria, potentially leading to unauthorized information disclosure or security policy bypass. The issue is resolved in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 10.0.0 to 10.1.3, 9.0.0 to 9.2.14
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
- 2026-07-29: patched: Fixed in versions 9.2.15 and 10.1.4