USN-8050-1: Apache Traffic Server vulnerability

USN-8050-1: Apache Traffic Server vulnerability

Publication date:18 February 2026
Overview: trafficserver could be made to crash if it received specially crafted input.

Packages
trafficserver - fast, scalable and extensible HTTP/1.1 and HTTP/2.0 caching proxy

Details
Masakazu Kitajo discovered that Apache Traffic Server did not properly
handle the Valid Host header field. An attacker could possibly use this
issue to cause a denial of service (DoS).

Update instructions
The problem can be corrected by updating your system to the following package versions:

• 25.10 questing trafficserver – 9.2.5+ds-1ubuntu2.1
• 24.04 LTS noble trafficserver – 9.2.3+ds-1+deb12u1ubuntu0.1
• 22.04 LTS jammy trafficserver – 9.1.1+ds-2ubuntu0.1