Vulnerability Details CVE-2026-33930
Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 14.1%
CVSS Severity
CVSS v3 Score 5.9
Products affected by CVE-2026-33930
-
cpe:2.3:a:apache:traffic_server:10.0.0
-
cpe:2.3:a:apache:traffic_server:10.0.1
-
cpe:2.3:a:apache:traffic_server:10.0.2
-
cpe:2.3:a:apache:traffic_server:10.0.3
-
cpe:2.3:a:apache:traffic_server:10.0.4
-
cpe:2.3:a:apache:traffic_server:10.0.5
-
cpe:2.3:a:apache:traffic_server:10.0.6
-
cpe:2.3:a:apache:traffic_server:10.1.0
-
cpe:2.3:a:apache:traffic_server:10.1.1
-
cpe:2.3:a:apache:traffic_server:10.1.2
-
cpe:2.3:a:apache:traffic_server:10.1.3
-
cpe:2.3:a:apache:traffic_server:8.0.0
-
cpe:2.3:a:apache:traffic_server:8.0.1
-
cpe:2.3:a:apache:traffic_server:8.0.2
-
cpe:2.3:a:apache:traffic_server:8.0.3
-
cpe:2.3:a:apache:traffic_server:8.0.4
-
cpe:2.3:a:apache:traffic_server:8.0.5
-
cpe:2.3:a:apache:traffic_server:8.0.6
-
cpe:2.3:a:apache:traffic_server:8.0.7
-
cpe:2.3:a:apache:traffic_server:8.0.8
-
cpe:2.3:a:apache:traffic_server:8.1.0
-
cpe:2.3:a:apache:traffic_server:8.1.1
-
cpe:2.3:a:apache:traffic_server:8.1.2
-
cpe:2.3:a:apache:traffic_server:8.1.3
-
cpe:2.3:a:apache:traffic_server:8.1.4
-
cpe:2.3:a:apache:traffic_server:8.1.5
-
cpe:2.3:a:apache:traffic_server:8.1.6
-
cpe:2.3:a:apache:traffic_server:8.1.7
-
cpe:2.3:a:apache:traffic_server:8.1.8
-
cpe:2.3:a:apache:traffic_server:8.1.9