Apache Traffic Server Fixes 38 Vulnerabilities Including ACL Bypass and RCE Risks

The Apache Software Foundation has released emergency patches for Apache Traffic Server (ATS), addressing a staggering 38 vulnerabilities in versions 9.2.15 and 10.1.4.

The disclosure, published by PMC member Masakazu Kitajo on July 29, 2026, covers flaws ranging from request smuggling and memory corruption to authentication bypass issues affecting core proxy logic and numerous plugins.

Apache Traffic Server is a widely deployed caching and reverse proxy platform used by CDNs, telecoms, and large-scale web infrastructure operators to handle high-volume HTTP traffic. Given its position at the network edge, vulnerabilities here carry outsized risk, as a single flaw can expose everything sitting behind the proxy.

Apache Traffic Server Fixes 38 Vulnerabilities

The most severe issue, CVE-2026-22068 (rated important), stems from ATS’s use of unanchored regular expressions across remap rules and several plugins.

Because these patterns aren’t anchored to the start or end of the input, attackers can craft substring or suffix matches that slip past ACL, SNI, signature, and geo-based access controls. In practice, this means security policies that administrators believe are enforcing strict boundaries could be silently bypassed.

A cluster of vulnerabilities revolves around HTTP request smuggling, a persistent class of bugs in proxy architectures. CVE-2026-33267 fails to strip hop-by-hop and internal headers from untrusted peers, enabling metadata injection.

CVE-2026-58150 allows HTTP/2 requests that include a Transfer-Encoding header to pass undetected, creating a downgrade-smuggling path.

Related issues, CVE-2026-58155 (header-name truncation) and CVE-2026-57834 (malformed chunked bodies), compound the risk by letting attackers desynchronize how front-end and back-end servers interpret the same request.

Several important-severity bugs point to deeper memory-handling issues. CVE-2026-58154 covers out-of-bounds writes and integer overflows during MIME and HTTP header parsing, while CVE-2026-58161 affects TLS and SNI handling, risking crashes via null dereferences.

CVE-2026-58151 highlights how abusive HTTP/2 framing and flow-control manipulation can exhaust server resources, a classic denial-of-service vector reminiscent of past HTTP/2 rapid-reset style attacks.

The Cripts scripting framework, exclusive to ATS 10.x, also drew scrutiny due to CVE-2026-58177, which includes out-of-bounds writes, path traversal, and use-after-free bugs.

Notably, this disclosure batch heavily targets ATS’s plugin architecture. The ts_lua, header_rewrite, regex_remap, txn_box, uri_signing, prefetch, intercept, webp_transform, and multiplexer plugins each received individual CVEs, mostly stack overflows, use-after-free conditions, or crash-inducing input handling.

The ESI plugin’s uncontrolled recursion and SSRF risk (CVE-2026-58178) are particularly notable in environments that process untrusted upstream content.

Two moderate-severity bugs deserve attention from TLS-heavy deployments. CVE-2026-41920 describes a one-sided length comparison between SNI and Host headers that can bypass host-SNI policy enforcement, while CVE-2026-65325 allows HTTP/2 multiplexed origin connections to be reused without re-verifying that the server certificate actually covers the new request’s hostname, a subtle but dangerous trust boundary violation.

Mitigation

Upgrade ATS 9.x deployments to version 9.2.15 immediately.
Upgrade ATS 10.x deployments to version 10.1.4 immediately.
Audit ACL, SNI, and remap rules for reliance on unanchored regex patterns.
Review plugin configurations, especially Lua, header_rewrite, and ESI, for exposure to untrusted input.
Monitor logs for anomalous chunked-encoding or Transfer-Encoding headers indicative of smuggling attempts.

With 38 distinct CVEs in a single advisory, this release ranks among the more extensive security updates in ATS’s history. Organizations running Traffic Server at the edge should treat this as a priority patch cycle rather than routine maintenance.