OESA-2025-2053 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through...

Linux Distros Unpatched Vulnerability : CVE-2022-37392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server...

Linux Distros Unpatched Vulnerability : CVE-2023-30631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.pushmethodenabled didn't...

Linux Distros Unpatched Vulnerability : CVE-2021-32567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 ...

Linux Distros Unpatched Vulnerability : CVE-2021-27737

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin. CVE-2021-27737 Note that Nessus relies on the presence of th...

Linux Distros Unpatched Vulnerability : CVE-2020-17509

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic...

Linux Distros Unpatched Vulnerability : CVE-2023-39456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2...

Linux Distros Unpatched Vulnerability : CVE-2025-49763

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can u...

Linux Distros Unpatched Vulnerability : CVE-2024-31309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2...

Linux Distros Unpatched Vulnerability : CVE-2023-38522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for...

Linux Distros Unpatched Vulnerability : CVE-2024-35161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache...

Linux Distros Unpatched Vulnerability : CVE-2025-31698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ACL configured in ipallow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting...

The vulnerability of the Apache Traffic Server web server, related to deficiencies in access control, allows attackers to compromise the confidentiality of protected information.

The vulnerability of the Apache Traffic Server web server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality of the information being protected...

OESA-2025-1732 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache. Security Fixes: Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation in the United States. Apache Traffic Server ATS versions...

[SECURITY] Fedora 41 Update: trafficserver-9.2.11-1.fc41

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...

[SECURITY] Fedora 42 Update: trafficserver-10.0.6-1.fc42

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...

Apache Traffic Server Access Control Error Vulnerability

Apache Traffic Server ATS is the United States Apache Apache Foundation's set of scalable HTTP proxy and caching server. An access control error vulnerability exists in Apache Traffic Server ATS versions 10.0.0 through 10.0.6 and 9.0.0 through 9.2.10, which stems from an ACL configuration that do...

Apache Traffic Server Resource Management Error Vulnerability (CNVD-2025-15620)

Apache Traffic Server ATS is the United States Apache Apache Foundation's set of scalable HTTP proxy and caching server. A resource management error vulnerability exists in Apache Traffic Server ATS versions 10.0.0 through 10.0.5 and 9.0.0 through 9.2.10, which stems from the ESI plugin not...

Fedora 41 : trafficserver (2025-ed452354bb)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-ed452354bb advisory. Changes with Apache Traffic Server 9.2.11 12169 - 9.2.x: fix libyaml for gcc 15, and cherry-pick fedora:42 updates 12294 - Add a setting to choose t...

Fedora 42 : trafficserver (2025-512daf16b9)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-512daf16b9 advisory. Changes with Apache Traffic Server 10.0.6 12298 - Add a setting to choose the data source of IP address for ACL 12299 - Add max inclusion depth...