Apache Traffic Server (Apache Software Foundation) - vulnerabilities (CVEs)

111 CVEs, 16 in the last 30 days, 9 known versions, newest CVE from 2026-10-21. Vendor: Apache Software Foundation.

CVEs of Apache Traffic Server

CVE-2026-112381 - CVSS 8.2 (high), 2026-10-21: Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is…
CVE-2026-111817 - CVSS 6.9 (medium), 2026-10-21: Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the…
CVE-2026-111812 - CVSS 10 (critical), 2026-10-21: Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This…
CVE-2026-111811 - CVSS 9.4 (critical), 2026-10-21: Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects…
CVE-2026-111809 - CVSS 9.3 (critical), 2026-10-21: Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server:…
CVE-2026-111810 - CVSS 8.7 (high), 2026-10-21: Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many…
CVE-2026-111815 - CVSS 10 (critical), 2026-10-21: Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client…
CVE-2026-111814 - CVSS 10 (critical), 2026-10-21: Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction…
CVE-2026-111808 - CVSS 8.6 (high), 2026-10-21: Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic…
CVE-2026-111805 - CVSS 8.6 (high), 2026-10-21: Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic…
CVE-2026-111816 - CVSS 9.3 (critical), 2026-10-21: Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out…
CVE-2025-55702 - CVSS 8.7 (high), 2026-10-21: When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the…
CVE-2025-31699 - CVSS 9.1 (critical), 2026-10-21: Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never…
CVE-2026-111804 - CVSS 8.8 (high), 2026-10-21: Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to…
CVE-2026-111813 - CVSS 10 (critical), 2026-10-21: Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned)…
CVE-2026-102795 - CVSS 9.3 (critical), 2026-10-02: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through…
CVE-2026-65100 - CVSS 6.3 (medium), 2026-07-29: Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder…
CVE-2026-58189 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic…
CVE-2026-58188 - CVSS 8.4 (high), 2026-07-29: Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through…
CVE-2026-58187 - CVSS 7.5 (high), 2026-07-29: The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic…
CVE-2026-58186 - CVSS 8.2 (high), 2026-07-29: The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from…
CVE-2026-58185 - CVSS 9.8 (critical), 2026-07-29: The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through…
CVE-2026-58184 - CVSS 8.3 (high), 2026-07-29: The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache…
CVE-2026-58183 - CVSS 8.2 (high), 2026-07-29: The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through…
CVE-2026-58182 - CVSS 8.6 (high), 2026-07-29: The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from…
CVE-2026-58181 - CVSS 8.2 (high), 2026-07-29: The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from…
CVE-2026-58180 - CVSS 8.2 (high), 2026-07-29: The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through…
CVE-2026-58179 - CVSS 9.8 (critical), 2026-07-29: The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58178 - CVSS 8.2 (high), 2026-07-29: The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58177 - CVSS 9.8 (critical), 2026-07-29: The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from…
CVE-2026-58175 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through…
CVE-2026-58164 - CVSS 8.3 (high), 2026-07-29: Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from…
CVE-2026-58163 - CVSS 9.1 (critical), 2026-07-29: Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58162 - CVSS 10 (critical), 2026-07-29: The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from…
CVE-2026-58161 - CVSS 9.2 (critical), 2026-07-29: Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58160 - CVSS 6.5 (medium), 2026-07-29: Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through…
CVE-2026-58159 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58158 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58157 - CVSS 8.7 (high), 2026-07-29: Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server:…
CVE-2026-58156 - CVSS 6.3 (medium), 2026-07-29: Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-58155 - CVSS 9.3 (critical), 2026-07-29: Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic…
CVE-2026-58154 - CVSS 9.2 (critical), 2026-07-29: Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0…
CVE-2026-65325 - CVSS 6.3 (medium), 2026-07-29: Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue…
CVE-2026-65324 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue…
CVE-2026-58153 - CVSS 8.3 (high), 2026-07-29: Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects…
CVE-2026-58152 - CVSS 6.9 (medium), 2026-07-29: Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through…
CVE-2026-58151 - CVSS 8.7 (high), 2026-07-29: Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server:…
CVE-2026-58150 - CVSS 10 (critical), 2026-07-29: Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server:…
CVE-2026-57834 - CVSS 10 (critical), 2026-07-29: Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from…
CVE-2026-33930 - CVSS 8.2 (high), 2026-07-29: Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header…
CVE-2026-24033 - CVSS 7.2 (high), 2026-07-29: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic…
CVE-2026-33267 - CVSS 10 (critical), 2026-07-29: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through…
CVE-2026-22068 - CVSS 8.2 (high), 2026-07-29: Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X…
CVE-2026-41920 - CVSS 9.3 (critical), 2026-07-29: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through…
CVE-2026-59173 - CVSS 7.5 (high), 2026-07-18: Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0…
CVE-2025-65114 - CVSS 7.5 (high), 2026-04-02: Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from…
CVE-2025-58136 - CVSS 7.5 (high), 2026-04-02: A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0…
CVE-2025-49763 - CVSS 7.5 (high), 2025-06-19: ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can…
CVE-2025-31698 - CVSS 7.5 (high), 2025-06-19: ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting…
CVE-2024-53868 - CVSS 7.5 (high), 2025-04-03: Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from…
CVE-2024-56195 - CVSS 6.3 (medium), 2025-03-06: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through…
CVE-2024-56196 - CVSS 6.3 (medium), 2025-03-06: Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended to…
CVE-2024-38311 - CVSS 6.3 (medium), 2025-03-06: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through…
CVE-2024-56202 - CVSS 4.3 (medium), 2025-03-06: Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through…
CVE-2024-50306 - CVSS 9.1 (critical), 2024-11-14: Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5,…
CVE-2024-50305 - CVSS 7.5 (high), 2024-11-14: Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users…
CVE-2024-38479 - CVSS 7.5 (high), 2024-11-14: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through…
CVE-2024-35296 - CVSS 8.2 (high), 2024-07-26: Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server:…
CVE-2024-35161 - CVSS 9.1 (critical), 2024-07-26: Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache…
CVE-2023-38522 - CVSS 7.5 (high), 2024-07-26: Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for…
CVE-2024-31309 - CVSS 7.5 (high), 2024-04-10: HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through…
CVE-2023-41752 - CVSS 7.5 (high), 2023-10-17: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through…
CVE-2023-39456 - CVSS 7.5 (high), 2023-10-17: Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through…
CVE-2023-33934 - CVSS 9.1 (critical), 2023-08-09: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
CVE-2022-47185 - CVSS 7.5 (high), 2023-08-09: Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server:…
CVE-2023-33933 - CVSS 7.5 (high), 2023-06-14: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic…
CVE-2023-30631 - CVSS 7.5 (high), 2023-06-14: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled…
CVE-2022-47184 - CVSS 7.5 (high), 2023-06-14: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic…
CVE-2022-40743 - CVSS 6.1 (medium), 2022-12-19: Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache…
CVE-2022-32749 - CVSS 7.5 (high), 2022-12-19: Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under…
CVE-2022-37392 - CVSS 5.3 (medium), 2022-12-19: Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server…
CVE-2022-31778 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue…
CVE-2022-28129 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects…
CVE-2022-31780 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache…
CVE-2022-25763 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks.…
CVE-2022-31779 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache…
CVE-2021-37150 - CVSS 7.5 (high), 2022-08-10: Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache…
CVE-2021-44759 - CVSS 8.1 (high), 2022-03-23: Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue…
CVE-2021-44040 - CVSS 7.5 (high), 2022-03-23: Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects…
CVE-2021-37148 - CVSS 7.5 (high), 2021-11-03: Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic…
CVE-2021-41585 - CVSS 7.5 (high), 2021-11-03: Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new…
CVE-2021-38161 - CVSS 8.1 (high), 2021-11-03: Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache…
CVE-2021-37149 - CVSS 7.5 (high), 2021-11-03: Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic…
CVE-2021-43082 - CVSS 9.8 (critical), 2021-11-03: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker…
CVE-2021-37147 - CVSS 7.5 (high), 2021-11-03: Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic…
CVE-2021-32567 - CVSS 7.5 (high), 2021-06-30: Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server…
CVE-2021-32566 - CVSS 7.5 (high), 2021-06-30: Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server…
CVE-2021-35474 - CVSS 9.8 (critical), 2021-06-30: Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to…
CVE-2021-27577 - CVSS 7.5 (high), 2021-06-29: Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server…
CVE-2021-32565 - CVSS 7.5 (high), 2021-06-29: Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server…