CVE-2026-22068
High · 8.2CVSS
8.2
EPSS
0.6%
Published
Jul 29, 2026
CISA due date
—
The record
Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-56021 Webmin allows unauthenticated attackers to read the contents of any file ending in .conf… CWE-777
- CVE-2026-40110 Jupyter Server is the backend for Jupyter web applications. CWE-777
- CVE-2026-39087 ntfy before 2.22.0 allows SSRF because of an unanchored regular expression for web push… CWE-777