Apache Traffic Server: TLS session resumption bypasses client certificate check
Summary
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying the client certificate required by the resumed host's verify_client STRICT policy. An unauthenticated remote attacker may be able to reach protected hostnames that require client certificates, with a high impact on confidentiality and integrity. The issue only matters where one ATS instance serves hostnames with mixed client-certificate requirements, for example via sni.yaml.
Affected
- Apache Traffic Server 8.0.0 through 8.1.11
- Apache Traffic Server 9.0.0 through 9.2.15
- Apache Traffic Server 10.0.0 through 10.1.4
- Apache Traffic Server 10.2.0
Fixed in
- 9.2.16
- 10.1.5
- 10.2.1
- No fixed 8.x release is named by the vendor. Unknown.
Workaround
- Unknown. The vendor documents no workaround.
- Limiting session resumption on hosts that require client certificates is an untested suggestion, not a vendor recommendation.
Exploitation
- Exploitation in the wild: not known. Not listed as known exploited in the sources reviewed.
- VulDB states no exploit is available. No public proof of concept was found.
- CISA SSVC: automatable yes, technical impact total.
Our recommendation
- Check whether any Apache Traffic Server instance exists, including appliances and vendor-bundled proxies.
- Check the version, the sni.yaml configuration and whether the instance is internet-facing.
- Upgrade 9.x to 9.2.16, 10.1.x to 10.1.5 and 10.2.x to 10.2.1 or later.
- Plan a migration away from 8.x, as no fix is named for that line.
- Note the severity discrepancy: CVSS 4.0 7.8 (NVD/CNA), CVSS 3.1 10.0 (Ubuntu), 3.7 (VulDB). Prioritise by exposure.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list announcement lists.apache.org
- Apache Traffic Server security advisory 2026-10 trafficserver.apache.org
- Ubuntu CVE record ubuntu.com
- VulDB entry vuldb.com
- CVE Threat Intelligence record cve.threatint.com
- Rescana security release summary www.rescana.com
- OpenCVE record app.opencve.io
- HOL Guard CVE summary hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:43.
Original description (NVD)
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.