Executive brief
Apache Traffic Server, a high-performance caching proxy used to manage web traffic, contains a flaw in how it handles website redirects. An attacker can send a specially crafted web request with an excessively long 'Host' header to crash the server. This could lead to a service outage, preventing users from accessing websites or services behind the proxy.
Technical details
A stack-based buffer overflow (CWE-121) exists in Apache Traffic Server during the handling of HTTP redirects. The vulnerability occurs when the software copies the client-provided 'Host' header into a fixed-size stack buffer without performing proper bounds checking. This occurs specifically when redirect following is enabled. A remote, unauthenticated attacker can exploit this by sending a request with an over-long Host header, potentially leading to a denial-of-service (DoS) via a process crash. The issue is resolved in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3
Timeline
- 2026-07-29: advisory: Vulnerability disclosed by Apache Software Foundation
- 2026-07-29: patched: Fixes released in versions 9.2.15 and 10.1.4