p PatchFirst

CVE-2026-102795

CVE-2026-102795 · Apache Traffic Server: SNI to Host header matching policy is not properly enforced

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.

CVSS 7.0 · High · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • apache traffic server

    Versions
    • ≥ 9.0.0, ≤ 9.2.14: Affected (semver)
    • ≥ 10.0.0, ≤ 10.1.3: Affected (semver)

    No fix published

  • trafficserver Debian:12

    Versions
    • 9.2.0+ds-2
    • 9.2.0+ds-2+deb12u1
    • 9.2.1+ds-1
    • 9.2.2+ds-1
    • 9.2.3+ds-1
    • 9.2.3+ds-1+deb12u1
    • 9.2.4+ds-0+deb12u1
    • 9.2.4+ds-1
    • 9.2.4+ds-2
    • 9.2.5+ds-0+deb12u1
    • 9.2.5+ds-0+deb12u2
    • 9.2.5+ds-0+deb12u3
    • 9.2.5+ds-0+deb12u4
    • 9.2.5+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • trafficserver Ubuntu:16.04:LTS

    Versions
    • 5.3.0-2ubuntu1
    • 5.3.0-2ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • trafficserver Ubuntu:18.04:LTS

    Versions
    • 7.0.0-5
    • 7.1.2+ds-2
    • 7.1.2+ds-2build1
    • 7.1.2+ds-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • trafficserver Ubuntu:Pro:20.04:LTS

    Versions
    • 8.0.5+ds-1
    • 8.0.5+ds-2
    • 8.0.5+ds-2build1
    • 8.0.5+ds-2ubuntu1
    • 8.0.5+ds-3
    • 8.0.5+ds-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • trafficserver Ubuntu:Pro:22.04:LTS

    Versions
    • 8.1.1+ds-1.1
    • 9.1.1+ds-2build1
    • 9.1.1+ds-2ubuntu0.1~esm1
    • 9.1.1+ds-2ubuntu0.1
    • 9.1.1+ds-2ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • trafficserver Ubuntu:24.04:LTS

    Versions
    • 9.2.1+ds-1build1
    • 9.2.2+ds-1
    • 9.2.3+ds-1
    • 9.2.3+ds-1+deb12u1
    • 9.2.3+ds-1+deb12u1build1
    • 9.2.3+ds-1+deb12u1build3
    • 9.2.3+ds-1+deb12u1build4
    • 9.2.3+ds-1+deb12u1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →