Executive brief
Apache Traffic Server, a high-performance caching proxy used to manage web traffic, contains a flaw in its intercept plugin. This vulnerability could allow a remote attacker to cause the service to crash, leading to a denial of service for users relying on the proxy. Organizations should update to the latest versions to ensure continuous availability of their web services.
Technical details
A use-after-free vulnerability exists within the intercept plugin of Apache Traffic Server. The flaw is triggered when the plugin attempts to access memory that has already been deallocated, typically during the handling of intercepted requests. An unauthenticated remote attacker can exploit this over the network, though the high attack complexity suggests specific timing or environmental conditions are required. Successful exploitation results in a crash of the Traffic Server process (Denial of Service). The issue is resolved in versions 9.2.15 and 10.1.4.
Affected products
- Apache Software Foundation Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory