Executive brief
Apache Traffic Server, a high-performance web proxy and caching server, contains a vulnerability in its Edge Side Includes (ESI) plugin. An attacker can exploit this to force the server into an infinite loop of requests or to fetch content from malicious external websites. This can lead to a complete service outage (denial of service) and potentially impact the performance of the underlying network infrastructure.
Technical details
An uncontrolled recursion vulnerability (CWE-674) exists in the Edge Side Includes (ESI) plugin of Apache Traffic Server. The plugin fails to properly limit recursion depth when processing ESI tags, allowing it to fetch attacker-controlled URLs indefinitely. A remote, unauthenticated attacker can exploit this by providing a crafted response or configuration that triggers deep or infinite recursion. This results in resource exhaustion and a denial of service (DoS) condition. The issue is resolved in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 8.0.0 to 8.1.9, 9.0.0 to 9.2.14, 10.0.0 to 10.1.3
Timeline
- 2026-07-29: advisory: Initial disclosure by Apache Software Foundation
- 2026-07-29: disclosed