CVE-2026-33267
published 2026-07-29CVE-2026-33267: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through…
PriorityP260critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.38%
31.3th percentile
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | traffic_server | >= 10.0.0 < 10.1.4 | 10.1.4 |
| apache | traffic_server | >= 9.2.0 < 9.2.15 | 9.2.15 |
| apache_software_foundation | apache_traffic_server | 10.1.0 – 10.1.3 | — |
| apache_software_foundation | apache_traffic_server | 9.2.0 – 9.2.14 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.07.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Traffic Server up to 9.2.14/10.1.3 input validation (EUVD-2026-50169 / Nessus ID 333156)
vuldb·2026-08-07·CVSS 9.1
CVE-2026-33267 [CRITICAL] Apache Traffic Server up to 9.2.14/10.1.3 input validation (EUVD-2026-50169 / Nessus ID 333156)
A vulnerability was found in Apache Traffic Server up to 9.2.14/10.1.3 and classified as very critical. This issue affects some unknown processing. Such manipulation leads to improper input validation.
This vulnerability is referenced as CVE-2026-33267. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
Improper Input Validation vulnerability in Apache Traffic Server.
ghsa_unreviewed·2026-07-29
CVE-2026-33267 [HIGH] CWE-20 Improper Input Validation vulnerability in Apache Traffic Server.
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33267 Apache Traffic Server: untrusted @ headers can spoof ATS internal metadata
bugzilla·2026-07-29·CVSS 10.0
CVE-2026-33267 [CRITICAL] CVE-2026-33267 Apache Traffic Server: untrusted @ headers can spoof ATS internal metadata
CVE-2026-33267 Apache Traffic Server: untrusted @ headers can spoof ATS internal metadata
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Bugzilla
CVE-2026-33267 trafficserver: untrusted @ headers can spoof ATS internal metadata [epel-all]
bugzilla·2026-07-29·CVSS 10.0
CVE-2026-33267 [CRITICAL] CVE-2026-33267 trafficserver: untrusted @ headers can spoof ATS internal metadata [epel-all]
CVE-2026-33267 trafficserver: untrusted @ headers can spoof ATS internal metadata [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Bugzilla
CVE-2026-33267 trafficserver: untrusted @ headers can spoof ATS internal metadata [fedora-all]
bugzilla·2026-07-29·CVSS 10.0
CVE-2026-33267 [CRITICAL] CVE-2026-33267 trafficserver: untrusted @ headers can spoof ATS internal metadata [fedora-all]
CVE-2026-33267 trafficserver: untrusted @ headers can spoof ATS internal metadata [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
2026-07-29
Published