Loading story…
Apache disclosed and patched 38 vulnerabilities in Apache Traffic Server (ATS), affecting 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3, with one Cripts framework flaw limited to the 10.0.x line. The fixes were released in ATS 9.2.15 and 10.1.4, and Apache urged users to upgrade immediately. The issues span core ATS functionality and multiple plugins, including request smuggling flaws such as malformed chunked-body handling (CVE-2026-57834), HTTP/2 downgrade smuggling via Transfer-Encoding (CVE-2026-58150), unsafe trailer forwarding (CVE-2026-58153), and header-name truncation that can enable header aliasing and policy bypass (CVE-2026-58155). Apache also fixed an access-control bypass caused by unanchored regex mappings (CVE-2026-22068), spoofing of internal metadata through untrusted @ headers (CVE-2026-33267), and improper session reuse that could expose data across client connections (CVE-2026-58157).
The advisory also covers a broad set of memory-safety and availability bugs, including a stack-based buffer overflow in redirect handling via a long Host header (CVE-2026-33930), MIME and header parsing errors (CVE-2026-58154), TLS/SNI handling crashes (CVE-2026-58161), cache deserialization flaws (CVE-2026-58163), remap configuration use-after-free conditions (CVE-2026-58164), and resource-exhaustion issues in HTTP/2 and HTTP/3 processing (CVE-2026-65324, CVE-2026-58151). Multiple plugins were also affected, including header_rewrite, intercept, regex_remap, txn_box, ts_lua, prefetch, uri_signing, url_sig, webp_transform, certifier, and ESI, with impacts ranging from crashes and memory corruption to SSRF amplification, path traversal, and certificate trust weaknesses. An oss-sec follow-up said some fixes were visible on the master branch but at least some had not yet been merged into the upcoming 10.2.x stable branch.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
On July 29, 2026, multiple Apache Traffic Server vulnerabilities were recorded in CVE entries, including flaws involving request smuggling, memory corruption, denial of service, SSRF amplification, access-control bypass, and plugin-specific bugs. The entries consistently recommend upgrading to ATS 9.2.15 or 10.1.4.
Apache Traffic Server disclosed and fixed 38 vulnerabilities in releases 9.2.15 and 10.1.4, affecting ATS 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3, with one Cripts issue limited to 10.0.0 through 10.1.3. Apache urged affected users to upgrade as soon as possible.
An oss-sec post summarized Apache Traffic Server's disclosure of 38 vulnerabilities affecting versions prior to 9.2.15 and 10.1.4 and reiterated the recommendation to upgrade immediately. The follow-up note added that fixes appeared on the master branch but at least some had not yet been added to the upcoming 10.2.x stable branch.
A CVE record for CVE-2026-58155 described a critical Apache Traffic Server flaw involving truncation of over-long HTTP header names that can lead to header aliasing, request smuggling, and policy bypass. The record expanded the affected scope to include ATS 8.0.0 through 8.1.9, alongside 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3, and recommended upgrading to 9.2.15 or 10.1.4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
32 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcelists.apache.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Traffic Server has received security updates for **16 vulnerabilities**, including **four critical** and **eleven high-severity** issues affecting versions `8.0.0` through `8.1.9`, `9.0.0` through `9.2.14`, and `10.0.0` through `10.1.3`. CSIRT Italia said the flaws can enable **arbitrary code execution, denial of service, security restriction bypass, information disclosure, and tampering**, and assigned the advisory a high systemic impact score. Apache recommends upgrading affected deployments to **`9.2.15`** or **`10.1.4`**. The published CVEs include **`CVE-2026-58150`**, a critical HTTP/2 `Transfer-Encoding` handling flaw that enables downgrade request smuggling, as well as **`CVE-2026-58159`** for ACL bypass, **`CVE-2026-58161`** for TLS/SNI memory-safety crashes, and **`CVE-2026-58151`** for HTTP/2 resource-exhaustion denial of service. Additional issues affect multiple plugins, including **ESI** SSRF and recursion in `CVE-2026-58178`, stack and integer overflows in `regex_remap` (`CVE-2026-58179`), stack exhaustion in `uri_signing` and `url_sig` (`CVE-2026-58181`), resource-consumption flaws in `ts_lua` (`CVE-2026-58182`), crashes in `prefetch` (`CVE-2026-58183`), and memory-safety weaknesses in experimental plugins (`CVE-2026-58188`).
Jul 31, 2026
The Apache Software Foundation released **Apache HTTP Server 2.4.68** to patch 13 vulnerabilities affecting versions prior to `2.4.68`, with many issues spanning `2.4.0` through `2.4.67`. The flaws span multiple modules, including `mod_http2`, `mod_proxy_ftp`, `mod_proxy_html`, `mod_ssl`, `mod_ldap`, `mod_dav_fs`, `mod_xml2enc`, and `mod_headers`, and include use-after-free, heap and buffer overflows, out-of-bounds reads, denial-of-service conditions, cross-site scripting, privilege-escalation and path-handling weaknesses. Apache and national defenders, including Canada’s Cyber Centre, urged administrators to review the advisory and upgrade because workarounds are unavailable for most of the issues. Notable CVEs include `CVE-2026-49975`, a `mod_http2` denial-of-service bug triggered by excessive size values in malicious HTTP/2 requests; `CVE-2026-48913`, a `mod_http2` memory-corruption issue when file handles are exhausted; `CVE-2026-34355` and `CVE-2026-34356`, buffer-overflow flaws tied to untrusted backend systems in `mod_proxy_html` and `ProxyPassReverseCookie*`; `CVE-2026-44631`, a heap underflow in `ap_regname` caused by crafted regular expressions; `CVE-2026-29167`, a `mod_ldap` per-directory use-after-free; `CVE-2026-29170` and `CVE-2026-44186` in `mod_proxy_ftp`; `CVE-2026-44185` in `mod_ssl` OCSP handling; and `CVE-2026-42535` in `mod_dav_fs`. The release also ships non-security changes such as OpenSSL 4.0 support and `mod_http2` updates, but the immediate priority for exposed environments is upgrading all Apache HTTP Server deployments to `2.4.68`.
Jun 29, 2026
Apache disclosed five vulnerabilities in **Apache Answer** affecting versions through `2.0.0`, including a **critical** cross-site scripting issue tracked as `CVE-2026-25688`. The XSS flaw stems from insufficient sanitization of AI-generated answer content, allowing malicious script execution when users view affected pages. Apache also fixed `CVE-2026-25699`, an authorization bypass in timeline-related APIs that let authenticated users access deleted, private, or unapproved content and related revision history, potentially exposing personal information, and `CVE-2026-25700`, which left previously issued administrative tokens valid after an administrator account was suspended, deleted, or deactivated. The same release also addressed `CVE-2026-33582`, a denial-of-service bug in which a specially crafted TIFF upload could trigger excessive memory allocation and crash the server process, and `CVE-2026-34033`, which allowed authenticated users to inject arbitrary HTML into notification emails because script-related tags were not properly neutralized. Apache said all five issues are remediated in **Apache Answer `2.0.1`** and advised users to upgrade, with reports credited to Sho Odagiri, Reimar Fritz, and Andy Gill of ZephrSec Ltd.
Jun 29, 2026