CVE-2026-65324
Last modified
CVE-2026-65324 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Traffic Server | >= 8.0.0, <= 8.1.9 |
| Apache | Traffic Server | >= 9.0.0, < 9.2.15 |
| Apache | Traffic Server | >= 10.0.0, < 10.1.4 |
References
- https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6dVendor Advisory, Mailing List
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-65324?
How severe is CVE-2026-65324?
How do I fix CVE-2026-65324?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-65317Verba RAG application version 2.1.3 contains a server-side r…9.2
- CVE-2026-65318Verba RAG application version 2.1.3 contains an unauthentica…9.2
- CVE-2026-65319Feedbin (commit 739884a) contains an unauthenticated informa…8.7
- CVE-2026-6532Kismet protocol dissector crash in Wireshark 4.6.0 to 4.6.4 …5.5
- CVE-2026-65321PyAthena prior to 3.35.4 contains a sql injection vulnerabil…9.8
- CVE-2026-65323Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-65325Apache Traffic Server reuses multiplexed HTTP/2 origin conne…6.3
- CVE-2026-65329An authentication issue was addressed with improved state ma…5.9
- CVE-2026-6533Dissection engine LZ77 decompression crash in Wireshark 4.6.…5.5
- CVE-2026-65330The issue was addressed with improved memory handling. This …6.5
- CVE-2026-65331This issue was addressed through improved state management. …4.3
- CVE-2026-65332This issue was addressed through improved state management. …4.3
Are you affected by CVE-2026-65324?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST