CVE-2026-33267 is a critical (CVSS 10.0) improper input validation flaw in Apache Traffic Server. It affects 9.2.0 through 9.2.14 and 10.1.0 through 10.1.3. The Apache announcement recommends upgrading to 9.2.15 or 10.1.4.
What's affected
Apache Traffic Server from 9.2.0 through 9.2.14, and from 10.1.0 through 10.1.3. Fixed versions are 9.2.15 and 10.1.4.
The record does not describe the exact input or the code path, and I did not find more detail than the one line announcement. Read the Apache mailing list thread for any further notes.
How to check if you're exposed
Print the version of the running binary:
traffic_server -V
Compare it with the affected ranges. Check every cache and proxy node, since fleets often run mixed versions. If you run Traffic Server from a distribution package or a container image, check the vendor's package version as well, as backports may change the number.
Paste your lockfile into the free in-browser dependency scan to see which versions you resolve, including transitive ones. Gold also lists this CVE on its directory page.
What to do now
- Upgrade to 9.2.15 if you are on the 9.2 line, or 10.1.4 if you are on the 10.1 line.
- Roll the upgrade across every node and confirm each one with
traffic_server -V. - Read the Apache announcement for any extra mitigation steps.
- If you cannot upgrade soon, limit who can reach the proxy from untrusted networks.
Why it matters
The weakness class is CWE-20, improper input validation, a broad category. The vector shows network access, no privileges and a changed scope, which is why the score is the maximum. Scope change on a proxy is plausible, since a proxy sits between clients and the services behind it.
Because the public detail is thin, avoid guessing at the mechanics. Patch to the fixed versions and watch for any follow up from the project. The record does not flag this CVE as known exploited.
Quick check
Which version should I upgrade to?
Use 9.2.15 if you run the 9.2 line, or 10.1.4 if you run the 10.1 line, as the Apache announcement recommends.
Sources
Last reviewed: 19 October 2026.
