CVE-2026-22068
published 2026-07-29CVE-2026-22068: Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X…
PriorityP432medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.41%
34.7th percentile
Regular Expression without Anchors vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | traffic_server | >= 10.0.0 < 10.1.4 | 10.1.4 |
| apache | traffic_server | >= 9.0.0 < 9.2.15 | 9.2.15 |
| apache_software_foundation | apache_traffic_server | 10.0.x – 10.1.3 | — |
| apache_software_foundation | apache_traffic_server | 9.0.x – 9.2.14 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Traffic Server up to 10.1.3/9.2.14 incorrect regex (Nessus ID 333156 / WID-SEC-2026-2561)
vuldb·2026-08-07·CVSS 5.3
CVE-2026-22068 [MEDIUM] Apache Traffic Server up to 10.1.3/9.2.14 incorrect regex (Nessus ID 333156 / WID-SEC-2026-2561)
A vulnerability has been found in Apache Traffic Server up to 10.1.3/9.2.14 and classified as very critical. This vulnerability affects unknown code. This manipulation causes incorrect regular expression.
The identification of this vulnerability is CVE-2026-22068. It is possible to initiate the attack remotely. There is no exploit available.
The affected component should be upgraded.
GHSA
Regular Expression without Anchors vulnerability in Apache Traffic Server.
ghsa_unreviewed·2026-07-29
CVE-2026-22068 [MEDIUM] CWE-777 Regular Expression without Anchors vulnerability in Apache Traffic Server.
Regular Expression without Anchors vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-22068 trafficserver: regex mappings match with malicious domain names [fedora-all]
bugzilla·2026-07-29·CVSS 8.2
CVE-2026-22068 [HIGH] CVE-2026-22068 trafficserver: regex mappings match with malicious domain names [fedora-all]
CVE-2026-22068 trafficserver: regex mappings match with malicious domain names [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Regular Expression without Anchors vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Bugzilla
CVE-2026-22068 trafficserver: regex mappings match with malicious domain names [epel-all]
bugzilla·2026-07-29·CVSS 8.2
CVE-2026-22068 [HIGH] CVE-2026-22068 trafficserver: regex mappings match with malicious domain names [epel-all]
CVE-2026-22068 trafficserver: regex mappings match with malicious domain names [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Regular Expression without Anchors vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Bugzilla
CVE-2026-22068 Apache Traffic Server: regex mappings match with malicious domain names
bugzilla·2026-07-29·CVSS 8.2
CVE-2026-22068 [HIGH] CVE-2026-22068 Apache Traffic Server: regex mappings match with malicious domain names
CVE-2026-22068 Apache Traffic Server: regex mappings match with malicious domain names
Regular Expression without Anchors vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
2026-07-29
Published