CVE-2026-41920 - Apache Traffic Server: SNI to Host header matching policy is not properly enforced

HIGH

Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Published Jul 29, 2026

7.0

HIGH

CVSS 4.0

EPSS 0.53%

Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

Vendor Apache Software Foundation Product Apache Traffic Server Default
unaffected
Affected
- ≥ 10.0.0, ≤ 10.1.3
- ≥ 9.0.0, ≤ 9.1.14

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Apache Software Foundation	Apache Traffic Server	unaffected	Affected ≥ 10.0.0, ≤ 10.1.3 ≥ 9.0.0, ≤ 9.1.14

No remediation recorded yet.

Weaknesses (1)

CWE-284

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-50167		Advisory
https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d		vendor-advisoryVendor AdvisoryMailing List

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner apache

Published Jul 29, 2026

Updated Jul 29, 2026

Reserved Apr 22, 2026

CISA Vulnrichment

Updated Jul 29, 2026

NVD

Status Analyzed

Modified Aug 3, 2026

Red Hat

No data

ENISA EUVD

Assigner apache

Published Jul 29, 2026

Updated Jul 29, 2026

GitHub

No data