Executive brief
Apache Traffic Server, a high-performance caching proxy used to manage web traffic, contains a vulnerability that allows attackers to bypass security limits on web redirects. By exploiting this flaw, an attacker could force the server to repeatedly request internal or external resources, potentially leading to a denial-of-service condition or unauthorized internal network scanning. This could disrupt service availability and impact the overall performance of the web infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) amplification vulnerability exists in Apache Traffic Server due to an improper handling of the redirect limit. When specific plugins reset the retry counter, the server fails to enforce the configured maximum number of redirects. A remote, unauthenticated attacker can exploit this behavior to bypass redirect limits, potentially leading to resource exhaustion or internal network probing. The issue affects versions 8.x, 9.x, and 10.x, and is resolved in versions 9.2.15 and 10.1.4.
Affected products
- Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, 10.0.0 through 10.1.3
Timeline
- 2026-07-29: disclosed
- 2026-07-29: advisory