Apache Traffic Server patches 38 security flaws, including request smuggling and memory-safety bugs (CVSS 10.0)

On 2026-08-05 the Apache Software Foundation shipped Apache Traffic Server 9.2.15 / 10.1.4, fixing 38 vulnerabilities covering request smuggling, access-control bypass, and memory-safety crashes. CVE-2026-33267, CVE-2026-58150 and several others score CVSS 10.0. ATS is a core CDN/edge-cache component worldwide; upgrade immediately.

Incident overview

Early August 2026, the Apache Software Foundation issued 38 security updates for Apache Traffic Server (ATS) 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3, shipped as 9.2.15 and 10.1.4. The advisory includes multiple CVSS 10.0 (Critical) request-smuggling and access-control bypass flaws. No in-the-wild exploitation observed. No config-level workaround. Upgrade now.

Apache Traffic Server is among the most widely deployed caching proxies worldwide—reverse proxy, CDN edge, enterprise front-door. Blast radius includes:

• Large CDN provider edge nodes;
• Internal reverse proxies and API gateways;
• Cloud-native service mesh Ingress.

High-severity technical details

1. Request smuggling (CVSS 10.0)

Request smuggling is ATS's historically most severe class. This release patches two key CVEs:

• CVE-2026-33267: forged internal headers allowed between untrusted peers and ATS. Attacker injects headers that should only exist inside the proxy (`X-Forwarded-For`, `X-Forwarded-Proto`, `X-Real-IP`), bypassing ACL, rate limits, and IP-based access control;
• CVE-2026-58150: HTTP/2 handling fails to reject requests that include a `Transfer-Encoding` header. Parse desync between proxy and origin enables classic CL.TE / TE.CL request smuggling, injecting malicious requests onto downstream connections.

2. Access-control bypass

• CVE-2026-22068: unanchored regex used for ACL, SNI, and geo matching. Substring match bypasses rules such as `^/api/.*$`;
• CVE-2026-58156: port-parsing bug; port-specific ACLs fail.

3. Memory safety and DoS

• CVE-2026-58154: memory error in MIME parsing; process crash;
• CVE-2026-58161: memory error on the TLS/SNI path;
• CVE-2026-58179: stack overflow in the `regex_remap` plugin; ATS worker crash;
• Additional memory-safety issues on Varnish/ESI parse paths, 10.x series.

Typical exploitation scenario

# CL.TE request smuggling PoC: desync Transfer-Encoding parse between proxy and origin
POST / HTTP/1.1
Host: cdn.example.com
Content-Length: 13
Transfer-Encoding: chunked

0

GET /internal/admin HTTP/1.1
Host: backend.local
Foo: 

If the proxy ignores `Transfer-Encoding` while the origin honors `Content-Length`, the attacker appends an arbitrary internal path onto the next request—hitting internals only the proxy should reach, or bypassing ACL.

Impact assessment

• Scope: ATS sits on large global CDNs and many enterprise networks; blast radius is wide;
• Attack complexity: low (AC:L)—request smuggling and ACL bypass techniques are mature;
• Privileges: none (PR:N). Any client that can reach the ATS edge;
• Impact: forged sensitive headers, ACL bypass, cross-tenant request injection, process crash, potential RCE (config-dependent);
• Workaround: none per vendor. Must patch.

Remediation

1. Upgrade now

• 9.x: 9.2.15 or later;
• 10.x: 10.1.4 or later.

2. Upgrade steps

# CentOS / RHEL
yum upgrade trafficserver -y
systemctl restart trafficserver
trafficserver status

# Debian / Ubuntu
apt-get update && apt-get install --only-upgrade trafficserver -y
systemctl restart trafficserver

# Docker
docker pull apache/trafficserver:10.1.4
docker compose up -d

3. Hardening

• In `records.config`, explicitly disable end-to-end HTTP/2 `Transfer-Encoding` forwarding (keep as defense-in-depth after upgrade);
• Use anchored regex on `remap.config` and ACL rules (`^/api/.*$`); whitelist-test them;
• Verify SNI match logic in `ssl_server_name.yaml`;
• On WAF / upstream reverse proxies, validate `X-Forwarded-*` provenance; do not trust internal headers from untrusted sources.

4. Detection and response

• Hunt `logs/squid.log` and `diags.log` for anomalous 400 / 502 and connection-reuse glitches;
• Watch `proxy.process.http.transaction_counts.errors` via `traffic_ctl metric get`;
• Review `remap.config` change history; confirm ACLs were not rolled back;
• Audit complex regex in `regex_remap` plugin config; avoid triggering the CVE-2026-58179 stack overflow.

References

• Apache Traffic Server users mailing list announcement
• Apache Traffic Server security advisory index
• NSFOCUS: Apache Traffic Server 38-vulnerability advisory
• NVD CVE-2026-33267
• NVD CVE-2026-58150