Skip to content
Apache Software Foundation Traffic Server vulnerabilities
-
apache software foundation traffic server
Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
CVE-2026-112381
8.2 High
-
apache software foundation traffic server
Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout
CVE-2026-111817
6.9 Medium
-
apache software foundation traffic server
Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
CVE-2026-111812
7.0 High
-
apache software foundation traffic server
Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
CVE-2026-111811
9.4 Critical
-
apache software foundation traffic server
Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
CVE-2026-111809
6.9 Medium
-
apache software foundation traffic server
Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service
CVE-2026-111810
8.7 High
-
apache software foundation traffic server
Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
CVE-2026-111815
7.8 High
-
apache software foundation traffic server
Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
CVE-2026-111814
7.8 High
-
apache software foundation traffic server
Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
CVE-2026-111808
7.7 High
-
apache software foundation traffic server
Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
CVE-2026-111805
7.7 High
-
apache software foundation traffic server
Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
CVE-2026-111816
9.2 Critical
-
apache software foundation traffic server
Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
CVE-2025-55702
7.0 High
-
apache software foundation traffic server
Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
CVE-2025-31699
9.1 Critical
-
apache software foundation traffic server
Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
CVE-2026-111804
8.8 High
-
apache software foundation traffic server
Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
CVE-2026-111813
10.0 Critical
-
apache software foundation traffic server
Apache Traffic Server: SNI to Host header matching policy is not properly enforced
CVE-2026-102795
Fix available
7.0 High
-
apache traffic server
Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode
CVE-2026-65100
6.3 Medium
-
apache traffic server
Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification
CVE-2026-58189
8.2 High
-
apache traffic server
Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins
CVE-2026-58188
8.4 High
-
apache traffic server
Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service
CVE-2026-58187
6.3 Medium
-
apache traffic server
Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses
CVE-2026-58186
8.2 High
-
apache traffic server
Apache Traffic Server: Use-after-free in the intercept plugin
CVE-2026-58185
8.2 High
-
apache traffic server
Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory
CVE-2026-58184
8.3 High
-
apache traffic server
Apache Traffic Server: prefetch plugin can crash on attacker-influenced input
CVE-2026-58183
8.2 High
-
apache traffic server
Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors
CVE-2026-58182
8.2 High
-
apache traffic server
Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash
CVE-2026-58181
8.2 High
-
apache traffic server
Apache Traffic Server: txn_box plugin overflows the stack from attacker input
CVE-2026-58180
8.2 High
-
apache traffic server
Apache Traffic Server: regex_remap plugin overflows the stack from attacker input
CVE-2026-58179
9.2 Critical
-
apache traffic server
Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery
CVE-2026-58178
8.2 High
-
apache traffic server
Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework
CVE-2026-58177
8.3 High
-
apache traffic server
Apache Traffic Server: HostDB SRV handling leaks memory
CVE-2026-58175
8.2 High
-
apache traffic server
Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free
CVE-2026-58164
8.3 High
-
apache traffic server
Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server
CVE-2026-58163
8.3 High
-
apache traffic server
Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates
CVE-2026-58162
8.4 High
-
apache traffic server
Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server
CVE-2026-58161
9.2 Critical
-
apache traffic server
Apache Traffic Server: Out-of-bounds reads while parsing DNS responses
CVE-2026-58160
6.3 Medium
-
apache traffic server
Apache Traffic Server: Listener and ACL handling allow access-control bypass
CVE-2026-58159
7.0 High
-
apache traffic server
Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow
CVE-2026-58158
8.2 High
-
apache traffic server
Apache Traffic Server: Improper server-session reuse can expose data across client connections
CVE-2026-58157
6.9 Medium
-
apache traffic server
Apache Traffic Server: URL and port parsing errors allow access-control bypass
CVE-2026-58156
6.3 Medium
-
apache traffic server
Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling
CVE-2026-58155
9.2 Critical
-
apache traffic server
Apache Traffic Server: Memory-safety errors in MIME and header parsing
CVE-2026-58154
9.2 Critical
-
apache traffic server
Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification
CVE-2026-65325
6.3 Medium
-
apache traffic server
Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion
CVE-2026-65324
8.2 High
-
apache traffic server
Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely
CVE-2026-58153
6.3 Medium
-
apache traffic server
Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory
CVE-2026-58152
6.9 Medium
-
apache traffic server
Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server
CVE-2026-58151
8.7 High
-
apache traffic server
Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
CVE-2026-58150
7.8 High
-
apache traffic server
Apache Traffic Server: Malformed chunked message body allows request smuggling
CVE-2026-57834
7.0 High
-
apache traffic server
Apache Traffic Server: Buffer overflow via Host field that has a long string value
CVE-2026-33930
8.2 High
- Show olderLoading…