CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server 不受信任的 @ 标头 → 内部元数据伪造 CVSS 10.0（严重） · CWE-20 · GHSA-jrh6-9hgv-mqm7 摘要 Apache Traffic Server 保留以 @ 为前缀的标头（@Ats-Internal、@ICAP-Status、@TCPInfo 等）用于内部元数据 ：它们存在于内存中的标头结构里，但绝不会在网络上序列化。在受影响版本（9.2.0–9.2.14、10.1.0–10.1.3）中，来自客户端请求 和源站响应...

Linux Distros Unpatched Vulnerability : CVE-2026-102795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3...

CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795

Apache Traffic Server is affected by an Improper Access Control vulnerability due to the SNI to Host header matching policy not being properly enforced. This issue impacts versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 . To remediate this vulnerability, users are recommended to upgrade t...

CVE-2026-102795 Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795 Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

EUVD-2026-91766

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

CVE-2026-102795

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record...

PT-2026-96111

AI HTTP Terminator - New Desync Technique - Zero-Day Attack Path - 1. Feed an autonomous security system small fragments of HTTP RFCs as attack inspiration. 2. Generate and mutate thousands of unusual HTTP request patterns. 3. Test the candidates against live infrastructure and use anomaly...

Astra Linux – Vulnerability in Puma

Puma is an HTTP 1.1 server for Ruby/Rack applications. Before versions 5.5.1 and 4.3.9, using “puma” with a proxy that forwards HTTP header values containing the LF character could lead to HTTP request smuggling. A client could secretly send a request through a proxy, causing the proxy to send a...

[SECURITY] Fedora 43 Update: trafficserver-10.2.0-1.fc43

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...

Exploit for Improper Input Validation in Apache Traffic_Server

CVE-2026-33267 — Apache Traffic Server untrusted @ header →...

GHSA-R28C-9Q8G-F849

creationtimestamp| type| source ---|---|--- 2026-08-10 19:39:38+00:00| seen| https://gist.github.com/klemmanton-lgtm/4a24aedae8017b5aebed0300d07c7ee9 2026-08-10 19:39:38+00:00| seen| https://gist.github.com/klemmanton-lgtm/8b54bdd2fe9905dc89b9c8ccf42f5fc4 2026-08-17 10:21:36+00:00| seen|...

AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day

PortSwigger says HTTP Terminator, an artificial intelligence AI-assisted research system built by James Kettle , generated and proved new HTTP desynchronization techniques after exploring 30,000 candidate desync vectors. PortSwigger said a separate human-guided discovery cascade also exposed a...

OESA-2026-3310 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through...

Apache Traffic Server input validation vulnerability (CNVD-2026-30693)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is an input validation vulnerability in Apache Traffic Server, which stems from insecure decoding of the webptransform plugin. An attacker can exploit this vulnerabilit...

Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30698)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. Apache Traffic Server has a buffer overflow vulnerability, which stems from improper handling of input by the urisigning and urlsig plugins. Attackers can exploit this...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30701)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from the ESI plugin’s failure to properly handle recursive requests. Attackers can exploit...

Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30702)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a buffer overflow vulnerability in Apache Traffic Server, which stems from out-of-bounds writes, path traversal, and memory error references within the Cripts...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30704)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from use-after-free and check-time/usage time errors during remap configuration processing...