CVE-2026-33267

Analyzed Analyzed - Analysis Complete

Improper Input Validation in Apache Traffic Server

Publication date: 2026-07-29

Last updated on: 2026-08-05

Assigner: Apache Software Foundation

Description

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-05

Generated

2026-08-18

AI Q&A

2026-07-29

EPSS Evaluated

2026-08-17

NVD

CVE-2026-33267

EUVD

EUVD-2026-50169

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 9.2.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This is an Improper Input Validation vulnerability in Apache Traffic Server affecting versions 9.2.0 through 9.2.14 and 10.1.0 through 10.1.3. It allows attackers to send specially crafted input that the server fails to validate properly, potentially leading to unexpected behavior or security issues.

Detection Guidance

To detect this vulnerability, check the version of Apache Traffic Server running on your system. Compare it against the affected versions (9.2.0-9.2.14, 10.1.0-10.1.3). Use commands like 'traffic_server -v' or check package managers (e.g., 'apt list --installed | grep trafficserver' or 'yum list installed | grep trafficserver').

Impact Analysis

The vulnerability could allow remote attackers to cause denial of service, execute arbitrary code, or gain unauthorized access to sensitive data. Since the CVSS score is high (10.0 for v3.1), the impact is severe and could disrupt services relying on Apache Traffic Server.

Compliance Impact

The vulnerability is an Improper Input Validation issue in Apache Traffic Server. Without specific details on data exposure or processing impacts, it is unclear how this directly affects GDPR or HIPAA compliance. However, improper input validation can lead to unauthorized data access or processing, which may violate these regulations if sensitive data is compromised.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 immediately. Follow your distribution's update process or download the patched version from the official Apache Traffic Server website.

Hi! I’m here to help you understand CVE-2026-33267. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70