Skip to contentApache Traffic Server vulnerabilities
- apache traffic serverApache Traffic Server: Valid Host field value can cause crashesCVE-2024-50305Fix available7.5 High
- apache traffic serverApache Traffic Server: Cache key plugin is vulnerable to cache poisoning attackCVE-2024-38479Fix available7.5 High
- apache traffic serverApache Traffic Server: Incomplete field name check allows request smugglingCVE-2023-38522Fix available7.5 High
- apache traffic serverApache Traffic Server: Invalid Accept-Encoding can force forwarding requestsCVE-2024-35296Fix available8.2 High
- apache traffic serverApache Traffic Server: Incomplete check for chunked trailer section allows request smugglingCVE-2024-35161Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreApache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attackCVE-2024-31309Fix availableEPSS 92.5%7.5 High
- apache traffic server, fedoraproject fedora +1 moreApache Traffic Server: Malformed http/2 frames can cause an abortCVE-2023-39456Fix availableEPSS 58.3%7.5 High
- apache traffic server, fedoraproject fedora +1 moreApache Traffic Server: s3_auth plugin problem with hash calculationCVE-2023-41752Fix available7.5 High
- apache traffic serverApache Traffic Server: Differential fuzzing for HTTP request parsing discrepanciesCVE-2023-33934Fix available9.1 Critical
- apache traffic serverApache Traffic Server: Invalid Range header causes a crashCVE-2022-47185Fix available7.5 High
- eclipse jetty, ietf http, http/2 +166 more +168 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarationsCVE-2023-44487In KEVPublic exploitFix availableEPSS 100.0%7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreApache Traffic Server: Configuration option to block the PUSH method in ATS didn't workCVE-2023-30631Fix available7.5 High
- apache traffic serverApache Traffic Server: s3_auth plugin problem with hash calculationCVE-2023-33933Fix available7.5 High
- apache traffic server, debian linux +1 moreApache Traffic Server: The TRACE method can be use to disclose network informationCVE-2022-47184Fix available7.5 High
- apache traffic serverApache Traffic Server: Security issues with the xdebug pluginCVE-2022-40743Fix available6.1 Medium
- apache traffic serverApache Traffic Server: Improperly reading the client requestsCVE-2022-37392Fix available5.3 Medium
- apache traffic serverApache Traffic Server: Improperly handled requests can cause crashes in specific pluginsCVE-2022-32749Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreImproper HTTP/2 scheme and method validationCVE-2022-31779Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreImproper input validation on HTTP/2 headersCVE-2022-25763Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreHTTP/2 framing vulnerabilitiesCVE-2022-31780Fix available7.5 High
- apache traffic server, debian linux +1 moreTransfer-Encoding not treated as hop-by-hopCVE-2022-31778Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreInsufficient Validation of HTTP/1.x HeadersCVE-2022-28129Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreProtocol vs scheme mismatchCVE-2021-37150Fix available7.5 High
- apache traffic server, debian linux +1 moreImproper authentication vulnerability in TLS origin verificationCVE-2021-44759Fix available8.1 High
- apache traffic server, debian linux +1 moreHTTP request line fuzzing attacksCVE-2021-44040Fix available7.5 High
- apache traffic serverheap-buffer-overflow with stats-over-http pluginCVE-2021-43082Fix available9.8 Critical
- apache traffic serverATS stops accepting connections on FreeBSDCVE-2021-415857.5 High
- apache traffic server, debian linux +1 moreNot validating origin TLS certificateCVE-2021-38161Fix available8.1 High
- apache traffic server, debian linux +1 moreRequest Smuggling - multiple attacksCVE-2021-37149Fix available7.5 High
- apache traffic server, debian linux +1 moreRequest Smuggling - transfer encoding validationCVE-2021-37148Fix available7.5 High
- apache traffic server, debian linux +1 moreRequest Smuggling - LF line endingCVE-2021-37147Fix available7.5 High
- apache traffic server, debian linux +1 moreDynamic stack buffer overflow in cachekey pluginCVE-2021-35474Fix available9.8 Critical
- apache traffic server, debian linux +1 moreReading HTTP/2 frames too many timesCVE-2021-32567Fix available7.5 High
- apache traffic server, debian linux +1 moreSpecific sequence of HTTP/2 frames can cause ATS to crashCVE-2021-32566Fix available7.5 High
- apache traffic server, debian linux +1 moreHTTP Request Smuggling, content length with invalid chartersCVE-2021-32565Fix available7.5 High
- apache traffic server, debian linux +1 moreIncorrect handling of url fragment leads to cache poisoningCVE-2021-27577Fix available7.5 High
- apache traffic serverApache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.CVE-2021-277377.5 High
- apache traffic serverATS negative cache option is vulnerable to a cache poisoning attack. If you have this option...CVE-2020-17509Fix available7.5 High
- apache traffic serverThe ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please...CVE-2020-17508Fix available7.5 High
- apache traffic server, debian linux +1 moreApache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to...CVE-2020-9494Fix available7.5 High
- apache ats, traffic server, debian linux +2 moreApache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read...CVE-2020-9481Fix available7.5 High
- apache traffic server, debian linux +1 moreThere is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8...CVE-2020-1944Fix available9.8 Critical
- apache traffic server, debian linux +1 moreThere is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8...CVE-2019-17559Fix available9.8 Critical
- apache traffic server, debian linux +1 moreThere is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8...CVE-2019-17565Fix available9.8 Critical
- apache traffic serverApache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache...CVE-2019-10079Fix available7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +15 more +17 moreSome HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of serviceCVE-2019-9518Fix availableEPSS 25.4%7.5 High
- apache http server, traffic server, apple swiftnio +20 more +22 moreSome HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of serviceCVE-2019-9517Fix availableEPSS 27.0%7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +16 more +18 moreSome HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of serviceCVE-2019-9516Fix availableEPSS 57.5%7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +19 more +21 moreSome HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of serviceCVE-2019-9515Fix availableEPSS 87.3%7.5 High
- apache traffic server, apple swiftnio, canonical ubuntu linux +25 more +27 moreSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of serviceCVE-2019-9514Fix availableEPSS 82.8%7.5 High
- Show moreLoading…