Executive brief
Apache Traffic Server, a high-performance caching proxy, contains a flaw in how it handles secure connections to backend servers. The system may incorrectly reuse an existing encrypted connection for a different website without checking if the security certificate is valid for that new site. This could potentially allow traffic to be misrouted or intercepted, compromising the integrity of data being served to users.
Technical details
Apache Traffic Server (ATS) is vulnerable to improper certificate validation (CWE-295) when handling HTTP/2 connections to origin servers. The vulnerability occurs because ATS reuses existing multiplexed HTTP/2 origin connections for new requests without verifying that the origin's server certificate actually covers the hostname of the new request. An attacker could potentially exploit this to cause the proxy to send requests to an incorrect or unauthorized origin under the guise of a trusted connection. This issue affects versions 9.x prior to 9.2.15 and 10.x prior to 10.1.4. Users should upgrade to 9.2.15 or 10.1.4 to resolve the issue.
Affected products
- Apache Traffic Server 9.0.0 through 9.2.14, 10.0.0 through 10.1.3
Timeline
- 2026-07-29: advisory: Initial disclosure of CVE-2026-65325
- 2026-07-29: patched: Fixes released in versions 9.2.15 and 10.1.4