CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server untrusted @ header → internal metadata spoof CVSS 10.0 Critical · CWE-20 · GHSA-jrh6-9hgv-mqm7 Summary Apache Traffic Server reserves @-prefixed headers @Ats-Internal, @ICAP-Status, @TCPInfo, ... for internal metadata : they live in the in-memory header...

CVE-2026-112381

A flaw was found in Apache Traffic Server. A race condition can allow an unauthenticated remote attacker to cause a Denial of Service DoS by crashing the server. This vulnerability occurs when a client terminates a POST request connection while the server is processing a chunked origin response,...

CVE-2026-111817

A flaw was found in Apache Traffic Server. When configured to drop HTTP chunked trailers, the proxy incorrectly waits for data bytes that it has already discarded, stalling the transfer until the connection times out. A remote attacker can exploit this condition by sending chunked transfers,...

CVE-2026-111810

A flaw was found in Apache Traffic Server. When processing incoming requests, the server writes an unthrottled diagnostic log entry for each internal header that it strips. A remote attacker can exploit this issue by sending HTTP requests with an unusually high number of internal headers, causing...

CVE-2026-111808

A flaw was found in Apache Traffic Server. A remote attacker can exploit this vulnerability by sending a malformed padded HTTP/2 DATA frame. This issue causes the exhaustion of the backend HTTP/1.1 origin server's worker pool, resulting in a Denial of Service DoS. Mitigation Upgrade Apache Traffi...

CVE-2026-111805

A flaw was found in Apache Traffic Server. A remote attacker can exploit this vulnerability by sending an HTTP/2 request containing a truncated Content-Length header. This causes Apache Traffic Server to exhaust the worker connection pool of upstream HTTP/1.1 origin servers, resulting in a Denial...

CVE-2026-111804

A flaw was found in Apache Traffic Server's experimental WebAssembly WASM plugin. A remote attacker can trigger a use-after-free condition during transaction closure or supply unvalidated metric identifiers to the internal statistics interface. This flaw allows an attacker to cause an application...

CVE-2025-55702

A flaw was found in Apache Traffic Server. When a client sends a POST request with an Expect header and the origin server responds before consuming the full body, Traffic Server incorrectly parses the remaining unread body as a subsequent request. A remote attacker behind a front-end proxy sharin...

ats-authproxy-prefix

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · ats-authproxy-prefix ats-authproxy-prefix Class: Privilege leftover Reach: Remote Apache Traffic Server 10.2.0 b1df7334 - Apache Software Foundation authproxy --forward-header-prefix copies identity fields from a 2xx...

ats-cripts-rri-uaf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · ats-cripts-rri-uaf ats-cripts-rri-uaf Class: Crash Reach: Remote Apache Traffic Server 10.2.0 b1df7334 - Apache Software Foundation Cripts Remap::From / To URL still re-read the stack TSRemapRequestInfo after...

ats-esi-unix-recvport

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · ats-esi-unix-recvport ats-esi-unix-recvport Class: SSRF Reach: Remote Apache Traffic Server 10.2.0 b1df7334 - Apache Software Foundation ESI FetchSM PluginVC reports dest port 0. Remap treats port 0 as UDS and rewrite...

ats-ipallow-method-case

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · ats-ipallow-method-case ats-ipallow-method-case Class: Privilege leftover Reach: Remote Apache Traffic Server 10.2.0 b1df7334 - Apache Software Foundation HTTP/1 mixed-case methods skip the default ipallow.yaml deny o...

ats-jsonrpc-unrestricted

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · ats-jsonrpc-unrestricted ats-jsonrpc-unrestricted Class: Privilege leftover recon Reach: Local Apache Traffic Server 10.2.0 b1df7334 - Apache Software Foundation JSON-RPC unix socket defaults to restrictedapi false...

ats-magick-unsigned

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · ats-magick-unsigned ats-magick-unsigned Class: File write Reach: Remote Apache Traffic Server 10.2.0 b1df7334 - Apache Software Foundation experimental magick runs ImageMagick ConvertImageCommand from ?magick=...

ats-realip-plugin-acl

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · ats-realip-plugin-acl ats-realip-plugin-acl Class: Privilege leftover Reach: Remote Apache Traffic Server 10.2.0 b1df7334 - Apache Software Foundation experimental realip plus the documented acl.subjects: PLUGIN...

ats-redirect-zero-net

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · ats-redirect-zero-net ats-redirect-zero-net Class: SSRF Reach: Remote Apache Traffic Server 10.2.0 b1df7334 - Apache Software Foundation redirect.actions default routable:follow classifies 0.0.0.0/8 except INADDRANY a...

ats-regex-remap-userinfo

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · ats-regex-remap-userinfo ats-regex-remap-userinfo Class: SSRF Reach: Remote Apache Traffic Server 10.2.0 b1df7334 - Apache Software Foundation regexremap $n substitution is concatenated into a string and fed to...

Linux Distros Unpatched Vulnerability : CVE-2026-111817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed proxy.config.http.dropchunkedtrailers until the connection...

Linux Distros Unpatched Vulnerability : CVE-2026-111812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue...

Linux Distros Unpatched Vulnerability : CVE-2025-55702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the...