Executive brief
Apache Traffic Server, a high-performance caching proxy used to manage web traffic, contains a flaw in how it processes web addresses (URLs). An attacker could exploit this to bypass security rules that restrict access based on specific network ports. This could allow unauthorized access to internal resources or services that were intended to be protected by the proxy.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Apache Traffic Server due to improper parsing of port information within URLs and userinfo fields. By crafting specific URL structures, a remote attacker can cause the server to misinterpret the destination port, effectively bypassing access control lists (ACLs) configured to restrict traffic based on port numbers. The vulnerability affects versions 8.x, 9.x, and 10.x. Users are advised to upgrade to versions 9.2.15 or 10.1.4 to remediate this issue.
Affected products
- Apache Traffic Server 8.0.0 - 8.1.9, 9.0.0 - 9.2.14, 10.0.0 - 10.1.3
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory
- 2026-07-29: patched