Loading story…
Apache Traffic Server has received security updates for 16 vulnerabilities, including four critical and eleven high-severity issues affecting versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. CSIRT Italia said the flaws can enable arbitrary code execution, denial of service, security restriction bypass, information disclosure, and tampering, and assigned the advisory a high systemic impact score. Apache recommends upgrading affected deployments to 9.2.15 or 10.1.4.
The published CVEs include CVE-2026-58150, a critical HTTP/2 Transfer-Encoding handling flaw that enables downgrade request smuggling, as well as CVE-2026-58159 for ACL bypass, CVE-2026-58161 for TLS/SNI memory-safety crashes, and CVE-2026-58151 for HTTP/2 resource-exhaustion denial of service. Additional issues affect multiple plugins, including ESI SSRF and recursion in CVE-2026-58178, stack and integer overflows in regex_remap (CVE-2026-58179), stack exhaustion in uri_signing and url_sig (CVE-2026-58181), resource-consumption flaws in ts_lua (CVE-2026-58182), crashes in prefetch (CVE-2026-58183), and memory-safety weaknesses in experimental plugins (CVE-2026-58188).
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
CSIRT Italia published an alert stating that security updates were available for multiple Apache Traffic Server vulnerabilities, including four critical and eleven high-severity issues. The notice highlighted impacts such as arbitrary code execution, denial of service, security restriction bypass, information disclosure, and tampering, and advised organizations to update according to the vendor bulletin.
On 2026-07-29, the Apache Software Foundation published a batch of vulnerability records for Apache Traffic Server affecting versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. The records recommend upgrading to versions 9.2.15 or 10.1.4 to remediate issues including request smuggling, access-control bypass, memory-safety flaws, denial of service, and plugin-specific bugs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
16 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed and patched **38 vulnerabilities** in Apache Traffic Server (ATS), affecting `9.0.0` through `9.2.14` and `10.0.0` through `10.1.3`, with one Cripts framework flaw limited to the `10.0.x` line. The fixes were released in **ATS `9.2.15` and `10.1.4`**, and Apache urged users to upgrade immediately. The issues span core ATS functionality and multiple plugins, including request smuggling flaws such as malformed chunked-body handling (`CVE-2026-57834`), HTTP/2 downgrade smuggling via `Transfer-Encoding` (`CVE-2026-58150`), unsafe trailer forwarding (`CVE-2026-58153`), and header-name truncation that can enable header aliasing and policy bypass (`CVE-2026-58155`). Apache also fixed an access-control bypass caused by unanchored regex mappings (`CVE-2026-22068`), spoofing of internal metadata through untrusted `@` headers (`CVE-2026-33267`), and improper session reuse that could expose data across client connections (`CVE-2026-58157`). The advisory also covers a broad set of memory-safety and availability bugs, including a stack-based buffer overflow in redirect handling via a long `Host` header (`CVE-2026-33930`), MIME and header parsing errors (`CVE-2026-58154`), TLS/SNI handling crashes (`CVE-2026-58161`), cache deserialization flaws (`CVE-2026-58163`), remap configuration use-after-free conditions (`CVE-2026-58164`), and resource-exhaustion issues in HTTP/2 and HTTP/3 processing (`CVE-2026-65324`, `CVE-2026-58151`). Multiple plugins were also affected, including `header_rewrite`, `intercept`, `regex_remap`, `txn_box`, `ts_lua`, `prefetch`, `uri_signing`, `url_sig`, `webp_transform`, `certifier`, and `ESI`, with impacts ranging from crashes and memory corruption to SSRF amplification, path traversal, and certificate trust weaknesses. An oss-sec follow-up said some fixes were visible on the master branch but at least some had not yet been merged into the upcoming `10.2.x` stable branch.
Jul 31, 2026
The Apache Software Foundation released **Apache HTTP Server 2.4.68** to patch 13 vulnerabilities affecting versions prior to `2.4.68`, with many issues spanning `2.4.0` through `2.4.67`. The flaws span multiple modules, including `mod_http2`, `mod_proxy_ftp`, `mod_proxy_html`, `mod_ssl`, `mod_ldap`, `mod_dav_fs`, `mod_xml2enc`, and `mod_headers`, and include use-after-free, heap and buffer overflows, out-of-bounds reads, denial-of-service conditions, cross-site scripting, privilege-escalation and path-handling weaknesses. Apache and national defenders, including Canada’s Cyber Centre, urged administrators to review the advisory and upgrade because workarounds are unavailable for most of the issues. Notable CVEs include `CVE-2026-49975`, a `mod_http2` denial-of-service bug triggered by excessive size values in malicious HTTP/2 requests; `CVE-2026-48913`, a `mod_http2` memory-corruption issue when file handles are exhausted; `CVE-2026-34355` and `CVE-2026-34356`, buffer-overflow flaws tied to untrusted backend systems in `mod_proxy_html` and `ProxyPassReverseCookie*`; `CVE-2026-44631`, a heap underflow in `ap_regname` caused by crafted regular expressions; `CVE-2026-29167`, a `mod_ldap` per-directory use-after-free; `CVE-2026-29170` and `CVE-2026-44186` in `mod_proxy_ftp`; `CVE-2026-44185` in `mod_ssl` OCSP handling; and `CVE-2026-42535` in `mod_dav_fs`. The release also ships non-security changes such as OpenSSL 4.0 support and `mod_http2` updates, but the immediate priority for exposed environments is upgrading all Apache HTTP Server deployments to `2.4.68`.
Jun 29, 2026
German authorities published security advisories for **Apache Traffic Server** and **Apache Tomcat/Tomcat Native**, warning of multiple vulnerabilities affecting the widely used web proxy, caching, and Java application server products. The notices identify separate issues in the two Apache projects, indicating that organizations running these technologies should review vendor guidance and determine whether exposed internet-facing services or internal application platforms are affected. The advisories provide limited public detail, but the affected software is commonly deployed in enterprise web delivery and application environments, raising the risk of service disruption, unauthorized access, or further compromise if vulnerable instances remain unpatched. Security teams are expected to prioritize asset identification, apply available updates from the Apache projects and downstream vendors, and monitor systems using **Apache Traffic Server**, **Apache Tomcat**, and **Tomcat Native** for signs of exploitation or abnormal activity.
Jun 29, 2026