Permissive Regular Expression in Apache Traffic Server - CVE-2026-22068
Published: August 24, 2026
Vulnerability identifier: #VU144765
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22068
CWE-ID: CWE-625
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass access controls.
The vulnerability exists due to improper regular expression handling in remap, SNI, and plugins when performing selection with unanchored regular expressions. A remote attacker can supply values that match substrings or suffixes to bypass access controls.
The issue affects ACL, SNI, signature, and geo controls.
Affected software
Apache Traffic Server
Fedora
trafficserver
Fedora
trafficserver
How to mitigate CVE-2026-22068
Install security update from vendor's website.
Apache Traffic Server - addressed in versions 9.2.14, 10.1.3
trafficserver - addressed in versions 9.2.15-1.el8, 9.2.15-1.el9, 10.1.4-1.fc43, 10.1.4-1.fc44, 10.2.0-1.fc43
trafficserver - addressed in versions 9.2.15-1.el8, 9.2.15-1.el9, 10.1.4-1.fc43, 10.1.4-1.fc44, 10.2.0-1.fc43