Apache Traffic Server improper exception handling vulnerability

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. It addresses an issue related to improper exception handling, which stems from empty pointer dereferencing and dangling references memory errors that occur during TLS and SNI...

Apache Traffic Server input validation vulnerability (CNVD-2026-30693)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is an input validation vulnerability in Apache Traffic Server, which stems from insecure decoding of the webptransform plugin. An attacker can exploit this vulnerabilit...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30704)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from use-after-free and check-time/usage time errors during remap configuration processing...

Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30702)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a buffer overflow vulnerability in Apache Traffic Server, which stems from out-of-bounds writes, path traversal, and memory error references within the Cripts...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30703)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from failing to properly release memory when processing HostDB SRV records. Attackers can...

Apache Traffic Server encryption vulnerability

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is an encryption-related vulnerability in Apache Traffic Server. This vulnerability stems from the certifier plugin generating certificates based on the client SNI...

Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30692)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. Apache Traffic Server has a buffer overflow vulnerability, which stems from the Multiplexer plugin failing to properly handle upstream inputs. Attackers can exploit this...

Apache Traffic Server deserialization injection vulnerability

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. Apache Traffic Server has a deserialization injection vulnerability, which stems from improper handling of disk cache fields and object lifecycle management. Attackers can...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30694)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from improper handling of object lifecycle in the intercept plugin. Currently, no detailed...

Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30695)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a buffer overflow vulnerability in Apache Traffic Server. This vulnerability stems from the headerrewrite plugin’s improper handling of memory during cookie operatio...

Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30700)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. Apache Traffic Server has a buffer overflow vulnerability, which stems from improper handling of substitute inputs by the regexremap plugin. Attackers can exploit this...

Apache Traffic Server resource management error vulnerability (CNVD-2026-30697)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is a resource management vulnerability in Apache Traffic Server, which stems from the improper handling of initialization, transform contexts, and per-instance state by...

Apache Traffic Server buffer overflow vulnerability (CNVD-2026-30699)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. Apache Traffic Server has a buffer overflow vulnerability, which stems from the improper handling of inputs by the txnbox plugin controlled by attackers. Attackers can exploi...

Apache Traffic Server input validation error vulnerability (CNVD-2026-30696)

Apache Traffic Server is a high-performance HTTP proxy server open source from the Apache Foundation in the United States. There is an input crash vulnerability in Apache Traffic Server. The reason for this vulnerability is that it fails to properly handle inputs affected by attackers. Attackers...

CVE-2026-33930

A flaw was found in Apache Traffic Server. A remote attacker could exploit a buffer overflow vulnerability by sending an excessively long Host header during redirect handling, provided that redirect following is enabled. This could cause a fixed-size stack buffer to overflow, leading to a denial ...

CVE-2026-58189

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

CVE-2026-65100

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from...

CVE-2026-58185

The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

CVE-2026-58181

The Apache Traffic Server urisigning and urlsig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which...

CVE-2026-58184

The Apache Traffic Server headerrewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version...