This vulnerability (CVE-2026-22068) in Apache Traffic Server is classified as CWE-777, indicating the use of a regular expression without anchors. Affected versions include 9.0.0 through 9.0.x (up to 9.1.0 exclusive) and 10.0.0 through 10.0.x (up to 10.1.0 exclusive). The lack of anchors in regular expressions can lead to unintended matches, potentially allowing attackers to exploit the system. The CVSS 3.1 base score is 8.2 (high), with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Users are advised to upgrade to Apache Traffic Server versions 9.2.15 or 10.1.4 where the issue is resolved.

The vulnerability allows remote attackers to impact the confidentiality of the system significantly, with limited impact on integrity and no impact on availability. It requires no privileges and no user interaction, making it easier to exploit over the network. The scope remains unchanged, meaning the vulnerability affects the same security authority. There are no known exploits in the wild at this time.

Users should upgrade affected Apache Traffic Server installations to versions 9.2.15 or 10.1.4 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is confirmed by the vendor advisory recommending these versions.