Traffic Server (Apache) - vulnerabilities (CVEs)

121 CVEs, 0 in the last 30 days, 233 known versions, newest CVE from 2026-07-29. Vendor: Apache.

CVEs of Traffic Server

CVE-2026-65100 - CVSS 6.3 (medium), 2026-07-29: Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder…
CVE-2026-58189 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic…
CVE-2026-58188 - CVSS 8.4 (high), 2026-07-29: Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through…
CVE-2026-58187 - CVSS 7.5 (high), 2026-07-29: The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic…
CVE-2026-58186 - CVSS 8.2 (high), 2026-07-29: The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from…
CVE-2026-58185 - CVSS 9.8 (critical), 2026-07-29: The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through…
CVE-2026-58184 - CVSS 8.3 (high), 2026-07-29: The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache…
CVE-2026-58183 - CVSS 8.2 (high), 2026-07-29: The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through…
CVE-2026-58182 - CVSS 8.6 (high), 2026-07-29: The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from…
CVE-2026-58181 - CVSS 8.2 (high), 2026-07-29: The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from…
CVE-2026-58180 - CVSS 8.2 (high), 2026-07-29: The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through…
CVE-2026-58179 - CVSS 9.8 (critical), 2026-07-29: The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58178 - CVSS 8.2 (high), 2026-07-29: The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58177 - CVSS 9.8 (critical), 2026-07-29: The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from…
CVE-2026-58175 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through…
CVE-2026-58164 - CVSS 8.3 (high), 2026-07-29: Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from…
CVE-2026-58163 - CVSS 9.1 (critical), 2026-07-29: Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58162 - CVSS 10 (critical), 2026-07-29: The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from…
CVE-2026-58161 - CVSS 9.2 (critical), 2026-07-29: Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58160 - CVSS 6.5 (medium), 2026-07-29: Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through…
CVE-2026-58159 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58158 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58157 - CVSS 8.7 (high), 2026-07-29: Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server:…
CVE-2026-58156 - CVSS 6.3 (medium), 2026-07-29: Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58155 - CVSS 9.3 (critical), 2026-07-29: Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic…
CVE-2026-58154 - CVSS 9.2 (critical), 2026-07-29: Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-65325 - CVSS 6.3 (medium), 2026-07-29: Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue…
CVE-2026-65324 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue…
CVE-2026-58153 - CVSS 8.3 (high), 2026-07-29: Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects…
CVE-2026-58152 - CVSS 6.9 (medium), 2026-07-29: Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through…
CVE-2026-58151 - CVSS 8.7 (high), 2026-07-29: Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server:…
CVE-2026-58150 - CVSS 10 (critical), 2026-07-29: Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server:…
CVE-2026-57834 - CVSS 10 (critical), 2026-07-29: Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from…
CVE-2026-33930 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header…
CVE-2026-24033 - CVSS 7.2 (high), 2026-07-29: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic…
CVE-2026-33267 - CVSS 10 (critical), 2026-07-29: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through…
CVE-2026-22068 - CVSS 8.2 (high), 2026-07-29: Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X…
CVE-2026-41920 - CVSS 9.3 (critical), 2026-07-29: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through…
CVE-2026-59173 - CVSS 7.5 (high), 2026-07-18: Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0…
CVE-2025-65114 - CVSS 7.5 (high), 2026-04-02: Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from…
CVE-2025-58136 - CVSS 7.5 (high), 2026-04-02: A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0…
CVE-2025-49763 - CVSS 7.5 (high), 2025-06-19: ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can…
CVE-2025-31698 - CVSS 7.5 (high), 2025-06-19: ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting…
CVE-2024-53868 - CVSS 7.5 (high), 2025-04-03: Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from…
CVE-2024-56195 - CVSS 6.3 (medium), 2025-03-06: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through…
CVE-2024-56196 - CVSS 6.3 (medium), 2025-03-06: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended to…
CVE-2024-38311 - CVSS 6.3 (medium), 2025-03-06: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through…
CVE-2024-56202 - CVSS 4.3 (medium), 2025-03-06: Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through…
CVE-2018-9481 - CVSS 6.5 (medium), 2024-11-20: In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure…
CVE-2024-50306 - CVSS 9.1 (critical), 2024-11-14: Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5,…
CVE-2024-50305 - CVSS 7.5 (high), 2024-11-14: Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users…
CVE-2024-38479 - CVSS 7.5 (high), 2024-11-14: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through…
CVE-2024-35296 - CVSS 8.2 (high), 2024-07-26: Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server:…
CVE-2024-35161 - CVSS 9.1 (critical), 2024-07-26: Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache…
CVE-2023-38522 - CVSS 7.5 (high), 2024-07-26: Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for…
CVE-2024-31309 - CVSS 7.5 (high), 2024-04-10: HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through…
CVE-2023-41752 - CVSS 7.5 (high), 2023-10-17: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through…
CVE-2023-39456 - CVSS 7.5 (high), 2023-10-17: Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2023-33934 - CVSS 9.1 (critical), 2023-08-09: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
CVE-2022-47185 - CVSS 7.5 (high), 2023-08-09: Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server:…
CVE-2023-33933 - CVSS 7.5 (high), 2023-06-14: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic…
CVE-2023-30631 - CVSS 7.5 (high), 2023-06-14: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled…
CVE-2022-47184 - CVSS 7.5 (high), 2023-06-14: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic…
CVE-2022-40743 - CVSS 6.1 (medium), 2022-12-19: Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache…
CVE-2022-37392 - CVSS 5.3 (medium), 2022-12-19: Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server…
CVE-2022-32749 - CVSS 7.5 (high), 2022-12-19: Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under…
CVE-2022-31780 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache…
CVE-2022-25763 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks.…
CVE-2022-31779 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache…
CVE-2021-37150 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache…
CVE-2022-31778 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue…
CVE-2022-28129 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects…
CVE-2021-44040 - CVSS 7.5 (high), 2022-03-23: Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects…
CVE-2021-44759 - CVSS 8.1 (high), 2022-03-23: Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue…
CVE-2021-38161 - CVSS 8.1 (high), 2021-11-03: Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache…
CVE-2021-37149 - CVSS 7.5 (high), 2021-11-03: Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic…
CVE-2021-43082 - CVSS 9.8 (critical), 2021-11-03: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker…
CVE-2021-37148 - CVSS 7.5 (high), 2021-11-03: Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic…
CVE-2021-41585 - CVSS 7.5 (high), 2021-11-03: Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new…
CVE-2021-37147 - CVSS 7.5 (high), 2021-11-03: Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic…
CVE-2021-32566 - CVSS 7.5 (high), 2021-06-30: Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server…
CVE-2021-35474 - CVSS 9.8 (critical), 2021-06-30: Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to…
CVE-2021-32567 - CVSS 7.5 (high), 2021-06-30: Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server…
CVE-2021-32565 - CVSS 7.5 (high), 2021-06-29: Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server…
CVE-2021-27577 - CVSS 7.5 (high), 2021-06-29: Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server…
CVE-2021-27737 - CVSS 7.5 (high), 2021-05-14: Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.
CVE-2020-17509 - CVSS 7.5 (high), 2021-01-11: ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic…
CVE-2020-17508 - CVSS 7.5 (high), 2021-01-11: The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and…
CVE-2020-9494 - CVSS 7.5 (high), 2020-06-24: Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to…
CVE-2020-9481 - CVSS 7.5 (high), 2020-04-27: Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.
CVE-2019-17559 - CVSS 9.8 (critical), 2020-03-23: There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to…
CVE-2020-1944 - CVSS 9.8 (critical), 2020-03-23: There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content…
CVE-2019-17565 - CVSS 9.8 (critical), 2020-03-23: There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to…
CVE-2019-10079 - CVSS 7.5 (high), 2019-10-22: Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent…
CVE-2019-9518 - CVSS 7.5 (high), 2019-08-13: Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with…
CVE-2019-9514 - CVSS 7.5 (high), 2019-08-13: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an…
CVE-2019-9517 - CVSS 7.5 (high), 2019-08-13: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2…
CVE-2019-9513 - CVSS 7.5 (high), 2019-08-13: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and…
CVE-2019-9516 - CVSS 7.5 (high), 2019-08-13: Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a…