CVE-2026-22068

MediumCVSS 5.3/10Last modified Oct 23, 2026

Description

Regular Expression without Anchors vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-777

Affected software

VendorProductVersions
Apache Software FoundationApache Traffic Server>= 10.0.x, <= 10.1.3; >= 9.0.x, <= 9.2.14

References

Timeline

Published
Jul 29, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-22075.3A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.jsCVE-2026-220709.8ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.CVE-2026-220728.3Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.CVE-2026-220775.6OPPO Wallet APP contains a trusted domain validation flaw that allows attackers to bypass protected interface access restrictions, which mayCVE-2026-220787.3Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions CVE-2026-220798.7This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmissioCVE-2026-22086.5A security vulnerability has been detected in WeKan up to 8.20. Impacted is an unknown function of the file server/publications/rules.js of CVE-2026-220808.7This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credeCVE-2026-220818.8This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flagCVE-2026-220828.8This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credentiCVE-2026-22094.3A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/seCVE-2026-220939.5The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This a
CVE-2026-22068: Medium severity, CVSS 5.3 | Vulnix