trafficserver vulnerabilities (Debian)
128 vulnerabilities.
-
trafficserverDebian Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response 8.2 High -
trafficserverDebian Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout 6.9 Medium -
trafficserverDebian Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials 7.0 High -
trafficserverDebian Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication 9.4 Critical -
trafficserverDebian Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling 6.9 Medium -
trafficserverDebian Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service 8.7 High -
trafficserverDebian Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement 7.8 High -
trafficserverDebian Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin 7.8 High -
trafficserverDebian Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion 7.7 High -
trafficserverDebian Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion 7.7 High -
trafficserverDebian Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out 9.2 Critical -
trafficserverDebian Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request 7.0 High -
trafficserverDebian Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling 9.1 Critical -
trafficserverDebian Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs 8.8 High -
trafficserverDebian Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration 10.0 Critical -
trafficserverDebian Apache Traffic Server: SNI to Host header matching policy is not properly enforced 7.0 High -
trafficserverDebian Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode 6.3 Medium -
trafficserverDebian Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification 8.2 High -
trafficserverDebian Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins 8.4 High -
trafficserverDebian Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service 6.3 Medium -
trafficserverDebian Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses 8.2 High -
trafficserverDebian Apache Traffic Server: Use-after-free in the intercept plugin 8.2 High -
trafficserverDebian Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory 8.3 High -
trafficserverDebian Apache Traffic Server: prefetch plugin can crash on attacker-influenced input 8.2 High -
trafficserverDebian Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors 8.2 High -
trafficserverDebian Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash 8.2 High -
trafficserverDebian Apache Traffic Server: txn_box plugin overflows the stack from attacker input 8.2 High -
trafficserverDebian Apache Traffic Server: regex_remap plugin overflows the stack from attacker input 9.2 Critical -
trafficserverDebian Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery 8.2 High -
trafficserverDebian Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework 8.3 High -
trafficserverDebian Apache Traffic Server: HostDB SRV handling leaks memory 8.2 High -
trafficserverDebian Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free 8.3 High -
trafficserverDebian Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server 8.3 High -
trafficserverDebian Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates 8.4 High -
trafficserverDebian Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server 9.2 Critical -
trafficserverDebian Apache Traffic Server: Out-of-bounds reads while parsing DNS responses 6.3 Medium -
trafficserverDebian Apache Traffic Server: Listener and ACL handling allow access-control bypass 7.0 High -
trafficserverDebian Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow 8.2 High -
trafficserverDebian Apache Traffic Server: Improper server-session reuse can expose data across client connections 6.9 Medium -
trafficserverDebian Apache Traffic Server: URL and port parsing errors allow access-control bypass 6.3 Medium -
trafficserverDebian Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling 9.2 Critical -
trafficserverDebian Apache Traffic Server: Memory-safety errors in MIME and header parsing 9.2 Critical -
trafficserverDebian Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification 6.3 Medium -
trafficserverDebian Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion 8.2 High -
trafficserverDebian Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely 6.3 Medium -
trafficserverDebian Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory 6.9 Medium -
trafficserverDebian Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server 8.7 High -
trafficserverDebian Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling 7.8 High -
trafficserverDebian Apache Traffic Server: Malformed chunked message body allows request smuggling 7.0 High -
trafficserverDebian Apache Traffic Server: Buffer overflow via Host field that has a long string value 8.2 High - Show olderLoading…