1218 matches found
Linux Distros Unpatched Vulnerability : CVE-2025-31698
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ACL configured in ipallow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting...
The vulnerability of the Apache Traffic Server web server, related to deficiencies in access control, allows attackers to compromise the confidentiality of protected information.
The vulnerability of the Apache Traffic Server web server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality of the information being protected...
OESA-2025-1732 trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation in the United States. Apache Traffic Server ATS versions...
[SECURITY] Fedora 41 Update: trafficserver-9.2.11-1.fc41
Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...
[SECURITY] Fedora 42 Update: trafficserver-10.0.6-1.fc42
Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...
Apache Traffic Server Resource Management Error Vulnerability (CNVD-2025-15620)
Apache Traffic Server ATS is the United States Apache Apache Foundation's set of scalable HTTP proxy and caching server. A resource management error vulnerability exists in Apache Traffic Server ATS versions 10.0.0 through 10.0.5 and 9.0.0 through 9.2.10, which stems from the ESI plugin not...
Apache Traffic Server Access Control Error Vulnerability
Apache Traffic Server ATS is the United States Apache Apache Foundation's set of scalable HTTP proxy and caching server. An access control error vulnerability exists in Apache Traffic Server ATS versions 10.0.0 through 10.0.6 and 9.0.0 through 9.2.10, which stems from an ACL configuration that do...
Fedora 41 : trafficserver (2025-ed452354bb)
The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-ed452354bb advisory. Changes with Apache Traffic Server 9.2.11 12169 - 9.2.x: fix libyaml for gcc 15, and cherry-pick fedora:42 updates 12294 - Add a setting to choose t...
Fedora 42 : trafficserver (2025-512daf16b9)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-512daf16b9 advisory. Changes with Apache Traffic Server 10.0.6 12298 - Add a setting to choose the data source of IP address for ACL 12299 - Add max inclusion depth...
[SECURITY] [DSA 5948-1] trafficserver security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5948-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 24, 2025 https://www.debian.org/security/faq -...
CVE-2025-49763 – Remote DoS via Memory Exhaustion in Apache Traffic Server via ESI Plugin
Remote attackers can trigger an avalanche of internal ESI requests, exhausting memory and causing denial-of-service in Apache Traffic Server. Executive Summary Imperva’s Offensive Security Team discovered CVE-2025-49763, a high-severity vulnerability CVSS v3.1 estimated score: 7.5 in Apache Traff...
OESA-2025-1659 trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2...
CVE-2025-31698
A flaw was found in trafficserver. Access control lists ACLs configured within ipallow.config or remap.config incorrectly utilize IP addresses, failing to account for those provided by the PROXY protocol. This can allow an attacker to bypass intended access restrictions by manipulating the source...
CVE-2025-49763
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin --max-inclusion-depth to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5,...
DEBIAN-CVE-2025-49763
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin --max-inclusion-depth to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5,...
CVE-2025-31698
ACL configured in ipallow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting proxy.config.acl.subjects to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol. This issue affects...
DEBIAN-CVE-2025-31698
ACL configured in ipallow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting proxy.config.acl.subjects to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol. This issue affects...
UBUNTU-CVE-2025-49763
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin --max-inclusion-depth to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5,...
UBUNTU-CVE-2025-31698
ACL configured in ipallow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting proxy.config.acl.subjects to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol. This issue affects...
CVE-2025-31698
Summary : CVE-2025-31698 affects Apache Traffic Server (ATS). The ACLs configured in ip_allow.config or remap.config may use IP addresses not provided by the PROXY protocol when ATS is configured to accept PROXY, exposing confidentiality. Affected ranges include 10.0.0–10.0.6 and 9.0.0–9.2.10. Ro...