Executive brief
Apache Traffic Server, a high-performance caching proxy used to manage web traffic, contains a vulnerability in how it processes certain web headers. An attacker could exploit this flaw to cause memory corruption, potentially leading to a service crash or instability. This could disrupt website availability and impact business operations that rely on the proxy for content delivery.
Technical details
An integer overflow vulnerability (CWE-190) exists in Apache Traffic Server during the decoding of HPACK and XPACK headers, which are used in HTTP/2 and HTTP/3 protocols. The flaw occurs when the server mishandles integer values, resulting in memory corruption. A remote, unauthenticated attacker can trigger this condition by sending specially crafted headers over the network. While the attack complexity is rated as high, successful exploitation primarily impacts service availability. The issue is resolved in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory