PT-2026-65717

CVE-2026-22068

Published

2026-07-29

Updated

2026-08-07

Description by

CVSS 4.0

9.2

Critical

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 10.0.X through 10.1.3 Apache Traffic Server versions 9.0.X through 9.2.14

Description Regular Expression without Anchors vulnerability allows regex mappings to match with malicious domain names.

Recommendations Upgrade Apache Traffic Server versions 10.0.X through 10.1.3 to version 10.1.4. Upgrade Apache Traffic Server versions 9.0.X through 9.2.14 to version 9.2.15.

Exploitability

Exploit

Fix

Researchers

Apache Community

Omkhar Arasaratnam

Vendors

Affected products

Weakness enumeration

CWE-777: Regular Expression without Anchors

Related identifiers

CVE-2026-22068