Description
Regular Expression without Anchors vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Published: 2026-07-29
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a Regular Expression without Anchors flaw in Apache Traffic Server. Because the engine performs regex matching without start‑ or end‑anchors, domain names that are intentionally crafted to resemble legitimate domains can satisfy the mapping regular expression. This can cause client requests to be redirected to unintended destinations or misrouted within the server. The weakness aligns with CWE‑777, indicating improper input validation in the regex engine.

Affected Systems

Apache Traffic Server versions 9.0.x through 9.2.14 and 10.0.x through 10.1.3 are affected. Systems that actively use regex‑based domain mappings with these releases are vulnerable, while later releases 9.2.15 and 10.1.4 contain the fix.

Risk and Exploitability

The CVSS score of 6.9 denotes moderate severity, and the EPSS score is below 1 %, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog.

Generated by OpenCVE AI on August 4, 2026 at 12:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Apache Traffic Server to the fixed versions 9.2.15 or 10.1.4.
  • Review the configuration and ensure that all regex patterns used for domain mapping are anchored at both ends; if anchors are not required, replace them with explicit literal matches or whitelist patterns.
  • Monitor traffic for unexpected redirects or anomalies that might indicate exploitation of the regex mapping bug.

Generated by OpenCVE AI on August 4, 2026 at 12:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 29 Jul 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
Vendors & Products Apache
Apache traffic Server

Wed, 29 Jul 2026 07:45:00 +0000

Type Values Removed Values Added
Description Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Title Apache Traffic Server: Regex mappings match with malicious domain names
Weaknesses CWE-777
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Apache Traffic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-29T13:14:03.128Z

Reserved: 2026-01-06T00:14:54.783Z

Link: CVE-2026-22068

cve-icon Vulnrichment

Updated: 2026-07-29T13:13:58.503Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-29T08:16:30.660

Modified: 2026-08-05T20:22:41.380

Link: CVE-2026-22068

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T12:45:05Z

Weaknesses
  • CWE-777

    Regular Expression without Anchors