CVE-2026-65325
Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verificationApache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
We have discovered 369 live websites that are affected by CVE-2026-65325.
Affected Software
| Product |  ATS |
| Category | Web Servers |
| Vulnerable Domains | 369 live websites (35% of ATS install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 11 versions ( 44% of all versions) |
Common Weakness Enumeration
CWE-295 Improper Certificate ValidationDetails
- Published - Jul 29, 2026
- Updated - Jul 29, 2026
Credits
- Apache Community (reporter)
- Omkhar Arasaratnam (reporter)
CVE References
CWE References
CWE
Website Distribution by Country
Number of websites using CVE-2026-65325 United States | 34 websites |
 Germany | 131 websites |
 China | 124 websites |
 GB | 36 websites |
 Isle of Man | 8 websites |
 Russia | 7 websites |
 Canada | 5 websites |
 Finland | 5 websites |
 Italy | 5 websites |
 France | 4 websites |
Website Distribution by TLD
Number of websites using CVE-2026-65325| .com.cn | 88 websites |
| .com | 59 websites |
| .cn | 23 websites |
| .org | 22 websites |
| .de | 20 websites |
| .org.uk | 11 websites |
| .net | 10 websites |
| .it | 8 websites |
| .ru | 7 websites |
| .fi | 7 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2026-65325
Top websites that are affected by CVE-2026-65325. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ****.******.jp |  Japan | **,*** | |
| ***.**********.de | Germany | **,*** | |
| *********.******.***.cn | China | **,*** | |
| ******.**********.de | Germany | ***,*** | |
| ******.***.cn | China | ***,*** | |
| *****.******.***.cn | China | ***,*** | |
| ***.***.**.uk | GB | ***,*** | |
| ****.******.***.cn | China | ***,*** | |
| *****.****.******.community | Germany | ***,*** | |
| *****.****.******.community | Germany | ***,*** |
FAQ
CVE-2026-65325 is Improper Certificate Validation in ATS
A total of 369 websites have been identified as vulnerable to CVE-2026-65325, based on global website indexing conducted by WebTechSurvey.
The ATS is affected by the CVE-2026-65325 vulnerability.
ATS versions up to and including 10.1.3 are vulnerable to CVE-2026-65325.