Apache Traffic Server vulnerabilities

• apache traffic server Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode CVE-2026-65100 Fix available 6.3 MediumJuly 29, 2026
• apache traffic server Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification CVE-2026-58189 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins CVE-2026-58188 Fix available 8.4 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service CVE-2026-58187 Fix available 6.3 MediumJuly 29, 2026
• apache traffic server Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses CVE-2026-58186 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Use-after-free in the intercept plugin CVE-2026-58185 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory CVE-2026-58184 Fix available 8.3 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: prefetch plugin can crash on attacker-influenced input CVE-2026-58183 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors CVE-2026-58182 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash CVE-2026-58181 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: txn_box plugin overflows the stack from attacker input CVE-2026-58180 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: regex_remap plugin overflows the stack from attacker input CVE-2026-58179 Fix available 9.2 CriticalJuly 29, 2026
• apache traffic server Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery CVE-2026-58178 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework CVE-2026-58177 8.3 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: HostDB SRV handling leaks memory CVE-2026-58175 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free CVE-2026-58164 Fix available 8.3 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server CVE-2026-58163 Fix available 8.3 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates CVE-2026-58162 Fix available 8.4 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server CVE-2026-58161 Fix available 9.2 CriticalJuly 29, 2026
• apache traffic server Apache Traffic Server: Out-of-bounds reads while parsing DNS responses CVE-2026-58160 Fix available 6.3 MediumJuly 29, 2026
• apache traffic server Apache Traffic Server: Listener and ACL handling allow access-control bypass CVE-2026-58159 Fix available 7.0 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow CVE-2026-58158 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Improper server-session reuse can expose data across client connections CVE-2026-58157 Fix available 6.9 MediumJuly 29, 2026
• apache traffic server Apache Traffic Server: URL and port parsing errors allow access-control bypass CVE-2026-58156 Fix available 6.3 MediumJuly 29, 2026
• apache traffic server Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling CVE-2026-58155 Fix available 9.2 CriticalJuly 29, 2026
• apache traffic server Apache Traffic Server: Memory-safety errors in MIME and header parsing CVE-2026-58154 Fix available 9.2 CriticalJuly 29, 2026
• apache traffic server Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification CVE-2026-65325 Fix available 6.3 MediumJuly 29, 2026
• apache traffic server Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion CVE-2026-65324 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely CVE-2026-58153 Fix available 6.3 MediumJuly 29, 2026
• apache traffic server Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory CVE-2026-58152 Fix available 6.9 MediumJuly 29, 2026
• apache traffic server Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server CVE-2026-58151 Fix available 8.7 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling CVE-2026-58150 Fix available 7.8 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Malformed chunked message body allows request smuggling CVE-2026-57834 Fix available 7.0 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Buffer overflow via Host field that has a long string value CVE-2026-33930 Fix available 8.2 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing CVE-2026-24033 Fix available 6.9 MediumJuly 29, 2026
• apache traffic server Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata CVE-2026-33267 Public exploitFix available 7.7 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: Regex mappings match with malicious domain names CVE-2026-22068 Fix available 6.9 MediumJuly 29, 2026
• apache traffic server Apache Traffic Server: SNI to Host header matching policy is not properly enforced CVE-2026-41920 Fix available 7.0 HighJuly 29, 2026
• apache traffic server Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions CVE-2026-59173 Fix available 7.5 HighJuly 18, 2026
• apache traffic server Apache Traffic Server: Malformed chunked message body allows request smuggling CVE-2025-65114 Fix available 7.5 HighApril 2, 2026
• apache traffic server Apache Traffic Server: A simple legitimate POST request causes a crash CVE-2025-58136 Fix available 7.5 HighApril 2, 2026
• apache traffic server Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL CVE-2025-31698 Fix available 7.5 HighJune 19, 2025
• apache traffic server Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin CVE-2025-49763 Fix available 7.5 HighJune 19, 2025
• apache traffic server Apache Traffic Server: Malformed chunked message body allows request smuggling CVE-2024-53868 Fix available 7.5 HighApril 3, 2025
• apache traffic server Apache Traffic Server: Request smuggling via pipelining after a chunked message body CVE-2024-38311 Fix available 6.3 MediumMarch 6, 2025
• apache traffic server Apache Traffic Server: Intercept plugins are not access controlled CVE-2024-56195 Fix available 6.3 MediumMarch 6, 2025
• apache traffic server Apache Traffic Server: ACL is not fully compatible with older versions CVE-2024-56196 6.3 MediumMarch 6, 2025
• apache traffic server Apache Traffic Server: Expect header field can unreasonably retain resource CVE-2024-56202 Fix available 4.3 MediumMarch 6, 2025
• apache traffic server, google android +1 more In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an... CVE-2018-9481 6.5 MediumNovember 20, 2024
• apache traffic server Apache Traffic Server: Server process can fail to drop privilege CVE-2024-50306 Fix available 9.1 CriticalNovember 14, 2024
• Show olderLoading…