CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced (supersedes CVE-2026-41920)
Apache Traffic Server improperly enforces SNI-to-Host matching; moderate CVE-2026-102795 is fixed in 9.2.15 and 10.1.4.
Apache disclosed moderate CVE-2026-102795, an improper access control flaw in Apache Traffic Server where the SNI-to-Host header matching policy is not properly enforced. Affected releases are 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3. Users should upgrade to 9.2.15 or 10.1.4. The new CVE supersedes CVE-2026-41920. No exploitation is reported.
- Moderate improper access control in Apache Traffic Server.
- SNI-to-Host header matching policy is not properly enforced.
- Affects versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3.
- Fixed in 9.2.15 and 10.1.4.
- This CVE supersedes CVE-2026-41920.
Vulnerabilities mentionedAll →
- CVE-2026-1027957.0—Improper Access Control in Apache Traffic Serverpublished · Apache Software Foundation Traffic Server
- CVE-2026-419207.0<1%Improper Access Control vulnerability in Apache Traffic Serverpublished · apache traffic server
Posted by Masakazu Kitajo on Oct 02 Severity: moderate Affected versions: - Apache Traffic Server 9.0.0 through 9.2.14 - Apache Traffic Server 10.0.0 through 10.1.3 Description: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed...
This source does not provide full text. Read it at seclists.org.