CVE-2026-41920 CRITICAL

CVE-2026-41920: Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Vendor Apache Software Foundation
Product Apache Traffic Server
Weakness CWE-284
Published July 29, 2026
Last update July 29, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

What the vulnerability does

01Description

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

Key dates

02Disclosure timeline

July 29, 2026 CVE published
July 29, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-2356 User Registration & Membership <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion CVE-2026-48898 Joomla! Core - [20260513] - Privilege escalation through com_users batch task CVE-2025-14977 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure CVE-2026-23899 Joomla! Core - [20260306] - Improper access check in webservice endpoints CVE-2024-13430 Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode