Apache Traffic Server: Log flooding denial of service via internal @ headers
Summary
Apache Traffic Server writes one unthrottled diagnostic log line for every internal @-prefixed header it strips. A request carrying many such headers causes the proxy to write far more log data than the request itself contains. An unauthenticated remote attacker can exploit this over the network to fill log storage and disrupt the service, provided the affected version is reachable.
Affected
- Apache Traffic Server 9.2.15
- Apache Traffic Server 10.1.4
- Apache Traffic Server 10.2.0
- Earlier releases are not listed as affected in the CVE record.
Fixed in
- Apache Traffic Server 9.2.16
- Apache Traffic Server 10.1.5
- Apache Traffic Server 10.2.1
Workaround
Unknown.
Exploitation
- Not known to be exploited in the wild.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS is very low (0.0036).
Our recommendation
- Check whether Apache Traffic Server is deployed in your environment, for example as reverse proxy, edge cache or CDN component.
- Upgrade to 9.2.16, 10.1.5 or 10.2.1 as soon as possible.
- Verify package updates with your Linux distribution's security tracker, as no confirmed fixed distribution packages were found.
- Until patched, make sure log partitions have free space and log rotation works, and restrict access to internet-facing instances where possible.
- Monitor disk usage of log partitions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache advisory trafficserver.apache.org
- Apache mailing list thread lists.apache.org
- Ubuntu security tracker ubuntu.com
- VulDB vuldb.com
- Vulners CVE record vulners.com
- HOL Guard CVE page hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:57.
Original description (NVD)
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.