CVE-2026-111812

Apache Traffic Servers originserverauth plugin lets a client force...

CVE-2026-111815

Apache Traffic Server can resume a TLS session across SNI virtual host...

CVE-2026-111811

Apache Traffic Servers experimental tsmemcache plugin allows unauthen...

CVE-2026-111813

Apache Traffic Servers experimental magick plugin lets an unauthentic...

CVE-2026-111814

Apache Traffic Servers default outbound session-sharing policy can re...

CVE-2025-31699

Apache Traffic Server can return an origin connection to the shared po...

CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server untrusted @ header → internal metadata spoof CVSS 10.0 Critical · CWE-20 · GHSA-jrh6-9hgv-mqm7 Summary Apache Traffic Server reserves @-prefixed headers @Ats-Internal, @ICAP-Status, @TCPInfo, ... for internal metadata : they live in the in-memory header...

Linux Distros Unpatched Vulnerability : CVE-2026-111815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient...

Linux Distros Unpatched Vulnerability : CVE-2025-55702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the...

Linux Distros Unpatched Vulnerability : CVE-2026-111812

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue...

Linux Distros Unpatched Vulnerability : CVE-2026-111813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration...

Linux Distros Unpatched Vulnerability : CVE-2026-111811

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects...

Linux Distros Unpatched Vulnerability : CVE-2025-31699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully...

Linux Distros Unpatched Vulnerability : CVE-2026-111814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction...

DEBIAN-CVE-2026-111817

Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed proxy.config.http.dropchunkedtrailers until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x i...

DEBIAN-CVE-2026-112381

Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This iss...

DEBIAN-CVE-2026-111812

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...

DEBIAN-CVE-2026-111815

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,...

DEBIAN-CVE-2026-111814

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0...

CVE-2026-111815

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verifyclient STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4,...