CVE-2026-65325: Apache Traffic Server Info Disclosure Flaw

CVE-2026-65325 Overview

CVE-2026-65325 is an improper certificate validation flaw [CWE-295] in Apache Traffic Server. The proxy reuses multiplexed HTTP/2 origin connections without verifying that the presented server certificate covers the hostname of the new request. An attacker positioned to influence request routing can cause requests intended for one origin to be sent over a Transport Layer Security (TLS) session established for a different origin. The issue affects Apache Traffic Server versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3. Fixed versions are 9.2.15 and 10.1.4.

Critical Impact
HTTP/2 connection coalescing bypasses per-request certificate hostname checks, allowing requests to reach origins that never presented a certificate valid for the requested hostname.

Affected Products

Apache Traffic Server 9.0.0 through 9.2.14
Apache Traffic Server 10.0.0 through 10.1.3
Downstream distributions packaging affected releases

Discovery Timeline

2026-07-29 - CVE-2026-65325 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-65325

Vulnerability Analysis

Apache Traffic Server (ATS) acts as a caching HTTP proxy between clients and origin servers. When ATS speaks HTTP/2 to an origin, a single TLS connection can carry many concurrent streams. HTTP/2 permits connection coalescing: reusing an existing connection for a different authority when the origin appears to serve it.

In the affected versions, ATS reuses these multiplexed origin connections without confirming that the certificate presented during the original TLS handshake also covers the hostname of the newly routed request. The Subject Alternative Name (SAN) and Common Name (CN) fields are not re-evaluated against the new request authority.

As a result, a request for hostA.example.com may be sent over a connection whose certificate only validates hostB.example.net. Confidentiality and integrity of the exchange are weakened because the trust binding between the request hostname and the TLS peer is broken.

Root Cause

The root cause is missing per-request certificate hostname validation during HTTP/2 origin connection reuse. ATS trusts the initial handshake and does not re-check the certificate's SAN list against subsequent request authorities routed onto the same connection. This is a classic [CWE-295] improper certificate validation defect applied to connection pooling.

Attack Vector

Exploitation requires network positioning that lets an attacker influence origin selection or DNS resolution so that unrelated hostnames resolve to an origin ATS already has an open HTTP/2 session with. No user interaction is required. The attacker does not need credentials on ATS. The impact is limited to integrity and confidentiality of routing decisions on the subsequent channel, not direct code execution on the proxy.

No verified public proof-of-concept code has been released. See the Apache Security Mailing List Post for the maintainer's technical description.

Detection Methods for CVE-2026-65325

Indicators of Compromise

Origin HTTP/2 sessions carrying request :authority values that do not match any Subject Alternative Name in the peer certificate observed for that session.
Unexpected origin server responses for hostnames the origin is not authoritative for, visible in ATS access logs.
Sudden increases in cross-authority request routing over persistent HTTP/2 connections to shared origin infrastructure.

Detection Strategies

Correlate ssl_server_name, negotiated certificate SANs, and per-request Host or :authority headers in proxy telemetry to flag mismatches.
Enable ATS debug tags for TLS and HTTP/2 origin session reuse, then alert on reuse events where the new authority is not covered by the cached peer certificate.
Inspect network captures at the ATS-to-origin boundary for HTTP/2 streams whose :authority values diverge from the TLS SNI presented on the same connection.

Monitoring Recommendations

Ingest ATS access and error logs into a centralized analytics platform and build detections on authority-versus-certificate mismatches.
Track the running Apache Traffic Server version across the fleet to identify hosts still on 9.0.0–9.2.14 or 10.0.0–10.1.3.
Monitor for anomalous origin response patterns, including 421 Misdirected Request responses that spike after configuration changes.

How to Mitigate CVE-2026-65325

Immediate Actions Required

Upgrade Apache Traffic Server to version 9.2.15 or 10.1.4, which contain the certificate hostname re-check on connection reuse.
Inventory all ATS instances, including containerized deployments, and prioritize public-facing and multi-tenant proxies.
Rotate any origin credentials or session tokens that may have transited a misdirected HTTP/2 stream during the exposure window.

Patch Information

The Apache Software Foundation released fixed builds in Apache Traffic Server 9.2.15 and 10.1.4. Both versions restore per-request validation that the origin certificate's SAN list covers the request authority before reusing a multiplexed HTTP/2 connection. Details are provided in the Apache Security Mailing List Post.

Workarounds

Disable HTTP/2 to origin servers until the patched version is deployed, forcing ATS to open per-authority HTTP/1.1 connections.
Restrict origin connection coalescing by pinning distinct origins to distinct upstream address groups so unrelated hostnames cannot share a connection.
Enforce strict SNI-based routing on origin load balancers to reject requests whose :authority does not match the negotiated certificate.

bash

# records.yaml (Apache Traffic Server 10.x) — disable HTTP/2 to origins as a temporary workaround
ts:
  ssl:
    client:
      # Do not negotiate h2 with origins; forces per-authority HTTP/1.1 connections
      alpn_protocols: http/1.1
  http2:
    # Ensure origin-side HTTP/2 is not offered
    upgrade_enabled: 0