CVE-2019-9513

CVE-2019-9513 (and related HTTP/2 CVEs) affect nginx and nghttp2. The issues enable denial of service via HTTP/2 resource loops and priority/window manipulation, causing high CPU/memory usage. nginx 1.16.x and nghttp2 are specifically named in advisories; remediation is upgrading to fixed package...

CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

CVE-2024-31309

Apache Traffic Server (ATS) is vulnerable to a Denial of Service (DoS) attack caused by an input validation error in the HTTP/2 stack. An attacker can exploit this by flooding the server with HTTP/2 CONTINUATION frames , leading to uncontrolled resource consumption and potential service interrupt...

CVE-2019-9517

CVE-2019-9517 describes an attack against some HTTP/2 implementations where unconstrained internal data buffering can cause a denial of service. The vulnerability arises when an attacker floods a connection with a large number of requests for a large response object while manipulating HTTP/2 flow...

CVE-2019-9511

CVE-2019-9511 is an HTTP/2 denial-of-service issue observed in multiple products where an attacker manipulates HTTP/2 window size and stream prioritization to force queuing of data in 1-byte chunks, potentially exhausting CPU/memory. Connected advisories confirm affected components include nginx ...

CVE-2019-9516

CVE-2019-9516 is an HTTP/2 header leak vulnerability affecting nginx and several Linux distributions. The issue occurs when an attacker sends streams with 0-length header names and values (optionally Huffman encoded), causing nginx to allocate memory for headers that may be kept until the session...

CVE-2019-9514

CVE-2019-9514 corresponds to an HTTP/2 vulnerability where an attacker floods a peer by sending HEADERS frames, causing unbounded memory growth and potential DoS. Public details in connected advisories show affected stacks include Go HTTP/2 implementations and Go-based tools, with remediation via...

CVE-2019-9512

CVE-2019-9512 is a HTTP/2 denial-of-service issue caused by ping floods that can trigger unbounded memory/CPU growth. Connected advisories confirm concrete remediation paths across environments: for Go-based HTTP/2 stacks, upgrading Go to 1.12.8 or newer (addresses CVE-2019-9512/9514 and related ...

CVE-2019-9518

CVE-2019-9518 describes a denial-of-service risk in HTTP/2 where a flood of frames with empty payloads (DATA, HEADERS, CONTINUATION, PUSH_PROMISE) and no end-of-stream flag can exhaust CPU and memory. Connected docs confirm concrete mentions across multiple ecosystems: Cloud Foundry products (emp...

CVE-2019-9515

CVE-2019-9515 concerns an HTTP/2 settings flood that can cause memory/CPU exhaustion. Arista’s security advisory (Security Advisory 0043) states the vulnerability is in Go’s gRPC HTTP/2 usage and can affect TerminAttr, OpenConfig, CVP, and certain Wi‑Fi OpenConfig-enabled components when enabled....

CVE-2024-53868

Apache Traffic Server is vulnerable to HTTP request smuggling due to the improper handling of malformed chunked messages . An attacker can exploit this environmental issue to send hidden requests, potentially tampering with requests and compromising server security. This vulnerability affects ver...

CVE-2020-9494

CVE-2020-9494 affects Apache Tomcat across multiple branches and versions: 7.0.0–7.0.107, 8.5.0–8.5.61, 9.0.0-M1–9.0.41, and 10.0.0-M1–10.0.0. The issue stems from handling of HTTP/2 HEADERS frames that can cause excessive memory allocation and thread spinning. Connected advisories note the fix f...

CVE-2021-44040

CVE-2021-44040 affects Apache Traffic Server, with improper input validation in request line parsing allowing attackers to send invalid requests. Affected versions: 8.0.0–8.1.3 and 9.0.0–9.1.1. Severity is reflected as high in 3.1 metrics. Mitigation: remediation exists via vendor/debian advisori...

CVE-2023-39456

CVE-2023-39456 affects Apache Traffic Server (ATS) before version 9.2.3. The issue is an improper input validation vulnerability triggered by malformed HTTP/2 frames, impacting ATS releases 9.0.0 through 9.2.2. Upgrading to ATS 9.2.3 is recommended and fixes the issue. The CVSS base metrics quote...

CVE-2023-33934

CVE-2023-33934 describes an Improper Input Validation vulnerability in the Apache Traffic Server. Affected software includes Traffic Server up to version 9.2.1 . Debian advisories indicate the issue is addressed in newer packages (e.g., Debian bookworm: 9.2.3+ds-1+deb12u1; Debian bullseye: 8.1.9+...

CVE-2018-8004

CVE-2018-8004 affects Apache Traffic Server (ATS) and is due to HTTP smuggling and cache‑poisoning issues. The vulnerability impacts ATS versions 6.0.0–6.2.2 and 7.0.0–7.1.3, with fixed releases 6.2.3+ and 7.1.4+ recommended. Public sources describe multiple parsing flaws (e.g., header parsing in...

CVE-2023-41752

CVE-2023-41752 affects Apache Traffic Server with exposure of sensitive information to an unauthorized actor. Affected versions are 8.0.0–8.1.8 and 9.0.0–9.2.2. Upgrading to 8.1.9 or 9.2.3 is the recommended fix. The vulnerability is described as an information disclosure issue, with a HIGH sever...

CVE-2019-10079

Apache Traffic Server (ATS) is vulnerable to HTTP/2 setting flood attacks due to not limiting the number of HTTP/2 setting frames from a client. Affected versions include older ATS releases; remediation is to upgrade to 7.1.7, 8.0.4, or later. The provided documents describe a denial-of-service r...

CVE-2020-9481

Apache Traffic Server (ATS) is affected by CVE-2020-9481. Versions 6.0.0–6.2.3, 7.0.0–7.1.9, and 8.0.0–8.0.6 are vulnerable to a HTTP/2 slow read attack, which can lead to denial of service (and is described in multiple sources as affecting ATS). The vulnerability stems from HTTP/2 handling in AT...

CVE-2022-47185

CVE-2022-47185 affects Apache Traffic Server up to version 9.2.1, due to an improper input validation vulnerability in the range header. Several connected sources confirm fixes in later releases: Debian security updates fix to 9.2.3+ds-1+deb12u1 (Debian DSA-5549‑1 / DLA-3595-1) and OSV entries do...

CVE-2026-58162

CVE-2026-58162 — Apache Traffic Server (certifier plugin) . The certifier plugin can generate certificates based on attacker-controlled client SNI, affecting Apache Traffic Server versions 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. The underlying issue is in how the certifier uses the client S...

CVE-2023-38522

Summary (CVE-2023-38522) : Apache Traffic Server is affected by an incomplete validation of HTTP field names, allowing malformed requests to be forwarded to origin servers. This can enable request smuggling and potentially cache poisoning if the origin is vulnerable. Affected versions include 8.0...

CVE-2021-35474

CVE-2021-35474 is a stack-based buffer overflow in the cachekey plugin of Apache Traffic Server, affecting ATS versions 7.0.0–7.1.12, 8.0.0–8.1.1, and 9.0.0–9.0.1. The Connected documents confirm the vulnerability and list affected versions; Debian's advisory DSA-4957-1 notes a fix in Debian for ...

CVE-2024-35161

Apache Traffic Server is vulnerable to a flaw where it forwards malformed HTTP chunked trailer sections to origin servers due to an incomplete check . This vulnerability can be exploited to perform request smuggling and potentially lead to cache poisoning if the backend origin servers are also vu...

CVE-2019-17559

Apache Traffic Server (ATS) versions affected: 6.0.0–6.2.3, 7.0.0–7.1.8, and 8.0.0–8.0.5. The vulnerability involves a smuggling attack and issues with scheme parsing. Upgrading to ATS 7.1.9 or later or 8.0.6 or later addresses the flaw. References indicate this is a documented vulnerability with...

CVE-2021-44759

CVE-2021-44759 affects Apache Traffic Server 8.0.0–8.1.0. The root cause is improper authentication in the TLS origin validation, enabling a man-in-the-middle attack. Impact is partial confidentiality, integrity, and availability. Publicly documented references indicate MITM risk via TLS origin v...

CVE-2020-17508

The CVE-2020-17508 entry concerns Apache Traffic Server’s ATS ESI plugin, with a memory disclosure vulnerability. Affected are ATS/Plugin versions: 7.0.0–7.1.11 and 8.0.0–8.1.0. The available data state that upgrading the plugin is required; no additional exploit details, affected file paths, or ...

CVE-2021-32566

Apache Traffic Server is affected by CVE-2021-32566 (Improper Input Validation in HTTP/2) which can lead to denial of service. The vulnerability affects ATS versions 7.0.0–7.1.12, 8.0.0–8.1.1, and 9.0.0–9.0.1. Evidence from multiple sources confirms the issue and its impact on availability (NVD C...

CVE-2020-1944

CVE-2020-1944 affects Apache Traffic Server (versions 6.0.0–6.2.3, 7.0.0–7.1.8, 8.0.0–8.0.5). The vulnerability is a smuggling attack involving Transfer-Encoding and Content-Length headers. The issue is severe: CVSSv3.1 base score 9.8 (CRITICAL) with network attack vector, no authentication, and ...

CVE-2021-27737

CVE-2021-27737 affects Apache Traffic Server 9.0.0, where the remote denial of service is triggered via the experimental Slicer plugin. The CVSS data indicate a high impact on availability (CVSS-3.1 base score 7.5). Connected documents confirm the vulnerable variant and suggest upgrading to 9.0.1...

CVE-2024-38479

Apache Traffic Server is vulnerable to an improper input validation flaw in its Cache Key Manipulation Plugin . This vulnerability allows a remote attacker to execute a cache poisoning attack due to insufficient validation of input data. The issue affects versions 8.0.0 through 8.1.11 and 9.0.0 t...

CVE-2022-31778

CVE-2022-31778 involves an ** Improper Input Validation** vulnerability in Apache Traffic Server’s handling of the Transfer-Encoding header, allowing an attacker to poison the cache. Affected products/versions: Apache Traffic Server 8.0.0–9.0.2 . Root cause (as stated): improper input validation ...

CVE-2021-27577

The CVE-2021-27577 issue affects Apache Traffic Server (ATS) and is caused by incorrect handling of URL fragments, enabling cache poisoning. Affected versions include ATS 7.0.0–7.1.12, 8.0.0–8.1.1, and 9.0.0–9.0.1. Impact is cache poisoning with potential denial of service implications depending ...

CVE-2022-40743

CVE-2022-40743 affects Apache Traffic Server (AS) 9.0.0–9.1.3, via an Improper Input Validation vulnerability in the xdebug plugin, leading to cross-site scripting and cache-poisoning . The issue is fixed by upgrading to Traffic Server 9.1.4 or later. The connected OSV entries corroborate the sam...

CVE-2025-49763

Apache Traffic Server (ATS) versions 9.0.0 through 9.2.10 and 10.0.0 through 10.0.5 are vulnerable to a remote denial-of-service (DoS) attack via memory exhaustion . The root cause is a lack of limits on the maximum inclusion depth within the ESI plugin , allowing unauthenticated attackers to tri...

CVE-2019-17565

CVE-2019-17565 affects Apache Traffic Server. Affected versions include 6.0.0–6.2.3, 7.0.0–7.1.8, and 8.0.0–8.0.5, with a smuggling attack via chunked encoding. Remediation per sources: upgrade to 7.1.9 or 8.0.6 or later. The vulnerability exists in ATS’s handling of HTTP requests and could allow...

CVE-2018-11783

CVE-2018-11783 affects the Apache Traffic Server sslheaders plugin. The plugin “extracts information from the client certificate and sets headers in the request based on the configuration,” and in some scenarios does not strip those headers from the request. This creates information exposure as h...

CVE-2021-37147

CVE-2021-37147 affects Apache Traffic Server: improper input validation in header parsing allows HTTP request smuggling. Affected versions are 8.0.0–8.1.2 and 9.0.0–9.1.0. Public sources describe risk of request smuggling and potential MITM. Patches/updates exist in Debian advisories (e.g., Bulls...

CVE-2021-43082

CVE-2021-43082 affects Apache Traffic Server 9.1.0 via the stats-over-http plugin. Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability that allows an attacker to overwrite memory. Documented references confirm the issue and its association with ATS 9....

CVE-2024-50305

Apache Traffic Server versions 9.2.0 through 9.2.5 are vulnerable to a crash due to insufficient validation of the Host header field . A remote attacker can exploit this improper input handling to cause a denial of service (DoS) or service interruptions on some platforms. Remediation involves upg...

CVE-2024-50306

The Apache Traffic Server proxy server contains a vulnerability where an unchecked return value of a privilege reset function allows the application to retain privileges on startup. This flaw could potentially allow an attacker to increase their privileges remotely. Affected versions include 9.2....

CVE-2022-25763

CVE-2022-25763 affects Apache Traffic Server 8.0.0–9.1.2 due to improper HTTP/2 request validation, enabling potential smuggle or cache-poison attacks. The initial document lists CVSS metrics (base 7.5/ HIGH) and impact as I:H, with no exploitation status provided. Remediation references exist in...

CVE-2024-56196

Apache Traffic Server versions 10.0.0 through 10.0.3 are affected by an Improper Access Control vulnerability. The root cause stems from deficiencies in access control lists (ACLs ), which could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of protected i...

CVE-2021-32565

Apache Traffic Server is affected by CVE-2021-32565 due to invalid values in the Content-Length header, enabling HTTP request smuggling. Affected releases: 7.0.0–7.1.12, 8.0.0–8.1.1, and 9.0.0–9.0.1. The issue’s root cause is improper handling of Content-Length values. Debian/DSA-4957-1 notes a f...

CVE-2023-30631

Apache Traffic Server (ATS) CVE-2023-30631: Improper input validation in the configuration option proxy.config.http.push_method_enabled caused the PUSH method handling to behave unexpectedly, potentially bypassing intended blocks. Affects ATS releases 8.0.0 through 9.2.0. Mitigation: upgrade to 8...

CVE-2024-35296

Apache Traffic Server (versions 8.0.0–8.1.10 and 9.0.0–9.2.4) is affected by CVE-2024-35296 due to incorrect handling of the Accept-Encoding header, which can cause cache lookups to fail and lead to forwarding requests. The issue is resolved by upgrading to 8.1.11 or 9.2.5. Certified advisories f...

CVE-2018-1318

CVE-2018-1318 affects Apache Traffic Server. The issue arises when adding method ACLs in remap.config, which can cause a segmentation fault under crafted requests. Vulnerable ATS versions: 6.0.0–6.2.2 and 7.0.0–7.1.3. Impact described as a segfault when handling certain inputs; no exploit details...

CVE-2022-47184

CVE-2022-47184 affects Apache Traffic Server, with affected versions 8.0.0–9.2.0. The issue is described as exposure of sensitive information to an unauthorized actor, and Debian/Fedora advisories indicate that the TRACE method can disclose network information. Multiple vendor advisories referenc...

CVE-2020-17509

CVE-2020-17509 affects Apache Traffic Server (ATS) where the negative cache option is vulnerable to cache poisoning. Affected versions are ATS 7.0.0–7.1.11 and 8.0.0–8.1.0. The underlying issue is linked to the negative cache option enabling a cache poisoning attack; if this option is enabled, up...

CVE-2022-28129

Apache Traffic Server versions 8.0.0–9.1.2 are affected by CVE-2022-28129 due to improper input validation in HTTP/1.1 header parsing, allowing an attacker to send invalid headers. Fedora advisories indicate upgrades to 9.1.3 (and 8.0.2+ds-1+deb10u7 for Debian) to fix the issue. CVSSv3 base score...