CVE-2026-22068 Apache Traffic Server: Regex mappings match with malicious domain names

Medium 6.9 Published 29 Jul 2026 Updated 29 Jul 2026

Attackers can bypass regex-based access controls in Apache Traffic Server by using malicious domain names that match unanchored patterns.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-22068?

CVE-2026-22068 is a medium-severity vulnerability in Apache Traffic Server, published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Regular Expression without Anchors vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

Weakness: CWE-777

Which versions are affected by CVE-2026-22068?

It affects 1 product.

Products include Apache Traffic Server.

How do I fix CVE-2026-22068?

Upgrade to a fixed version.

Is CVE-2026-22068 being exploited?

There is no known exploitation of CVE-2026-22068 in the wild and no public exploit code.

All Apache Traffic Server vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-22068, GHSA-mhwr-5c6p-qj97, UBUNTU-CVE-2026-22068.