Apache Traffic Server patches 38 flaws, some CVSS 10

Apache Traffic Server has shipped fixes for 38 security vulnerabilities in versions 9.2.15 and 10.1.4, including flaws the project rates as high as CVSS 10. Operators running 9.0.0 through 9.2.14 or 10.0.0 through 10.1.3 are urged to upgrade.

Among the more serious problems, unanchored regular expressions used for selection let substring and suffix matches slip past ACL, SNI, signature, and geo controls in remap and several plugins (CVE-2026-22068). Separately, the proxy failed to strip Connection-listed hop-by-hop headers and internal @ headers from untrusted peers before plugin hooks, opening the door to request smuggling and metadata injection (CVE-2026-33267). Both are rated important.

The remaining issues span a wide range of severities and components. Fixes are in the announced stable releases; according to Valtteri Vuorikoski’s note on oss-security, some have not yet landed on the upcoming 10.2.x stable branch. Masakazu Kitajo posted the full advisory for the Apache Traffic Server project.

Anyone exposing ATS as a reverse proxy or edge cache should treat the update as urgent, especially where regex-based ACLs or untrusted client traffic are in play.