Skip to contentApache Software Foundation Traffic Server vulnerabilities
- apache traffic serverApache Traffic Server: Request smuggling via chunked extension quoted-string parsingCVE-2026-240336.9 Medium
- apache traffic serverApache Traffic Server: Untrusted @ headers can spoof ATS internal metadataCVE-2026-33267Public exploit7.7 High
- apache traffic serverApache Traffic Server: Regex mappings match with malicious domain namesCVE-2026-220686.9 Medium
- apache traffic serverApache Traffic Server: SNI to Host header matching policy is not properly enforcedCVE-2026-419207.0 High
- apache traffic serverApache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditionsCVE-2026-591737.5 High
- apache traffic serverApache Traffic Server: Malformed chunked message body allows request smugglingCVE-2025-65114Fix available7.5 High
- apache traffic serverApache Traffic Server: A simple legitimate POST request causes a crashCVE-2025-58136Fix available7.5 High
- apache traffic serverApache Traffic Server: Client IP address from PROXY protocol is not used for ACLCVE-2025-31698Fix available7.5 High
- apache traffic serverApache Traffic Server: Remote DoS via memory exhaustion in ESI PluginCVE-2025-49763Fix available7.5 High
- apache traffic serverApache Traffic Server: Malformed chunked message body allows request smugglingCVE-2024-53868Fix available7.5 High
- apache traffic serverApache Traffic Server: Request smuggling via pipelining after a chunked message bodyCVE-2024-38311Fix available6.3 Medium
- apache traffic serverApache Traffic Server: Intercept plugins are not access controlledCVE-2024-56195Fix available6.3 Medium
- apache traffic serverApache Traffic Server: ACL is not fully compatible with older versionsCVE-2024-561966.3 Medium
- apache traffic serverApache Traffic Server: Expect header field can unreasonably retain resourceCVE-2024-56202Fix available4.3 Medium
- apache traffic serverApache Traffic Server: Server process can fail to drop privilegeCVE-2024-50306Fix available9.1 Critical
- apache traffic serverApache Traffic Server: Valid Host field value can cause crashesCVE-2024-50305Fix available7.5 High
- apache traffic serverApache Traffic Server: Cache key plugin is vulnerable to cache poisoning attackCVE-2024-38479Fix available7.5 High
- apache traffic serverApache Traffic Server: Incomplete field name check allows request smugglingCVE-2023-38522Fix available7.5 High
- apache traffic serverApache Traffic Server: Invalid Accept-Encoding can force forwarding requestsCVE-2024-35296Fix available8.2 High
- apache traffic serverApache Traffic Server: Incomplete check for chunked trailer section allows request smugglingCVE-2024-35161Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreApache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attackCVE-2024-31309Fix availableEPSS 92.5%7.5 High
- apache traffic server, fedoraproject fedora +1 moreApache Traffic Server: Malformed http/2 frames can cause an abortCVE-2023-39456Fix availableEPSS 58.3%7.5 High
- apache traffic server, fedoraproject fedora +1 moreApache Traffic Server: s3_auth plugin problem with hash calculationCVE-2023-41752Fix available7.5 High
- apache traffic serverApache Traffic Server: Differential fuzzing for HTTP request parsing discrepanciesCVE-2023-33934Fix available9.1 Critical
- apache traffic serverApache Traffic Server: Invalid Range header causes a crashCVE-2022-47185Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreApache Traffic Server: Configuration option to block the PUSH method in ATS didn't workCVE-2023-30631Fix available7.5 High
- apache traffic serverApache Traffic Server: s3_auth plugin problem with hash calculationCVE-2023-33933Fix available7.5 High
- apache traffic server, debian linux +1 moreApache Traffic Server: The TRACE method can be use to disclose network informationCVE-2022-47184Fix available7.5 High
- apache traffic serverApache Traffic Server: Security issues with the xdebug pluginCVE-2022-40743Fix available6.1 Medium
- apache traffic serverApache Traffic Server: Improperly reading the client requestsCVE-2022-37392Fix available5.3 Medium
- apache traffic serverApache Traffic Server: Improperly handled requests can cause crashes in specific pluginsCVE-2022-32749Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreImproper HTTP/2 scheme and method validationCVE-2022-31779Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreImproper input validation on HTTP/2 headersCVE-2022-25763Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreHTTP/2 framing vulnerabilitiesCVE-2022-31780Fix available7.5 High
- apache traffic server, debian linux +1 moreTransfer-Encoding not treated as hop-by-hopCVE-2022-31778Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreInsufficient Validation of HTTP/1.x HeadersCVE-2022-28129Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreProtocol vs scheme mismatchCVE-2021-37150Fix available7.5 High
- apache traffic server, debian linux +1 moreImproper authentication vulnerability in TLS origin verificationCVE-2021-44759Fix available8.1 High
- apache traffic server, debian linux +1 moreHTTP request line fuzzing attacksCVE-2021-44040Fix available7.5 High
- apache traffic serverheap-buffer-overflow with stats-over-http pluginCVE-2021-43082Fix available9.8 Critical
- apache traffic serverATS stops accepting connections on FreeBSDCVE-2021-415857.5 High
- apache traffic server, debian linux +1 moreNot validating origin TLS certificateCVE-2021-38161Fix available8.1 High
- apache traffic server, debian linux +1 moreRequest Smuggling - multiple attacksCVE-2021-37149Fix available7.5 High
- apache traffic server, debian linux +1 moreRequest Smuggling - transfer encoding validationCVE-2021-37148Fix available7.5 High
- apache traffic server, debian linux +1 moreRequest Smuggling - LF line endingCVE-2021-37147Fix available7.5 High
- apache traffic server, debian linux +1 moreDynamic stack buffer overflow in cachekey pluginCVE-2021-35474Fix available9.8 Critical
- apache traffic server, debian linux +1 moreReading HTTP/2 frames too many timesCVE-2021-32567Fix available7.5 High
- apache traffic server, debian linux +1 moreSpecific sequence of HTTP/2 frames can cause ATS to crashCVE-2021-32566Fix available7.5 High
- apache traffic server, debian linux +1 moreHTTP Request Smuggling, content length with invalid chartersCVE-2021-32565Fix available7.5 High
- apache traffic server, debian linux +1 moreIncorrect handling of url fragment leads to cache poisoningCVE-2021-27577Fix available7.5 High
- Show moreLoading…