Security2 hOctober 19, 2026, 10:00

Apache fixes CVE-2026-102795 in Traffic Server access control flaw

The Apache Software Foundation published eight CVEs on 2 October 2026 across OpenOffice, the Directory LDAP API and Traffic Server. CVE-2026-102795 is an improper access control flaw in Traffic Server 9.0.0–9.2.14 and 10.0.0–10.1.3, fixed in 9.2.15 and 10.1.4, with severity listed as both 7.0 (CVSS 4.0) and 9.3 (CVSSv3).

DEV Community

Open source

Apache fixes CVE-2026-102795 in Traffic Server access control flaw

CVE-2026-102795 affects Traffic Server 9.0.0–9.2.14 and 10.0.0–10.1.3
Fixes shipped in versions 9.2.15 and 10.1.4
Severity listed as 7.0 under CVSS 4.0 and 9.3 under CVSSv3
ZoomEye matched 311,469 Traffic Server assets but 0 for this CVE

#Apache#TrafficServer

Apache httpd 2.4.69 fixes 20 flaws, including CVE-2026-63292

Security

Apache Tomcat 11.0.26 fixes HTTP/2 header mix-up regression CVE-2026-86350

Software

Chromium update breaks Windows Server RD Web Access over 0.02% traffic

Security

Apache fixes CVE-2026-102795 in Traffic Server access control flaw

Apache httpd 2.4.69 fixes 20 flaws, including CVE-2026-63292

Apache Tomcat 11.0.26 fixes HTTP/2 header mix-up regression CVE-2026-86350

Chromium update breaks Windows Server RD Web Access over 0.02% traffic

Microsoft ships out-of-band fix for CVE-2026-96940 in Exchange Server