CVE-2026-65325

Analyzed Analyzed - Analysis Complete

Apache Traffic Server HTTP/2 Certificate Verification Bypass

Publication date: 2026-07-29

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-03

Generated

2026-08-18

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-17

NVD

CVE-2026-65325

EUVD

EUVD-2026-50207

Affected Vendors & Products

Vendor	Product	Version / Range
apache	traffic_server	From 10.0.0 (inc) to 10.1.4 (exc)
apache	traffic_server	From 9.0.0 (inc) to 9.2.15 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

Apache Traffic Server reuses HTTP/2 connections to different origins without checking if the server's certificate covers the new request hostname. This could allow an attacker to intercept or manipulate traffic for unauthorized domains.

Detection Guidance

This vulnerability involves improper certificate verification in HTTP/2 connections. To detect it, check Apache Traffic Server logs for connection reuse errors or hostname mismatches. Monitor for unexpected certificate validation failures during HTTP/2 requests. No specific commands are provided in the context.

Impact Analysis

An attacker could perform man-in-the-middle attacks, decrypt or alter traffic, or impersonate legitimate services. Users of affected versions (9.0.0-9.2.14, 10.0.0-10.1.3) are at risk of data exposure or service manipulation.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's confidentiality rules. Organizations must patch to maintain compliance.

Mitigation Strategies

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, which address this issue. Verify the upgrade was applied correctly by checking the installed version.

Hi! I’m here to help you understand CVE-2026-65325. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70