CVE-2026-65324

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in Apache Traffic Server via HTTP/2 or HTTP/3 Responses

Publication date: 2026-07-29

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-03

Generated

2026-08-18

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-17

NVD

CVE-2026-65324

EUVD

EUVD-2026-50206

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 8.0.0 (inc) to 8.1.9 (inc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Apache Traffic Server has a vulnerability where it incorrectly handles memory limits when processing HTTP/2 or HTTP/3 responses. The server drops the buffer cap during dechunking, allowing a slow client to consume excessive memory, potentially leading to a denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring Apache Traffic Server for unusual memory usage or slow client behavior during HTTP/2 or HTTP/3 response processing. Check server logs for excessive memory consumption or connection delays. Use system monitoring tools like top, htop, or ps to observe memory usage spikes in the Traffic Server process.

Impact Analysis

This vulnerability can cause Apache Traffic Server to run out of memory due to slow clients, resulting in service disruption or crashes. It may lead to degraded performance or complete unavailability of the server.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting server memory, potentially disrupting services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4 immediately. If upgrading is not possible, restrict access to HTTP/2 and HTTP/3 endpoints or disable them temporarily. Monitor network traffic for slow client attacks and implement rate limiting to prevent memory exhaustion.

Hi! I’m here to help you understand CVE-2026-65324. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70