CVE-2024-38311

Apache Traffic Server is vulnerable to an improper input validation issue that allows for HTTP request smuggling via pipelining after a chunked message body. This vulnerability affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.8, and 10.0.0 through 10.0.3. Exploitation allows a malicious a...

CVE-2024-56202

Apache Traffic Server is susceptible to an Expected Behavior Violation vulnerability when processing the Expect header . This flaw arises from discrepancies in functionality compared to specifications, which could allow a remote attacker to compromise the accessibility of protected information . ...

CVE-2022-31780

CVE-2022-31780 affects Apache Traffic Server (8.0.0–9.1.2) with an improper input validation in HTTP/2 frame handling that can allow request smuggling. Connected advisories confirm fixes: Debian DLA-3279 (trafficserver 8.0.2+ds-1+deb10u7) and Fedora updates (trafficserver 9.1.3-1.fc36/1.fc35). Op...

CVE-2021-37148

CVE-2021-37148 is an improper input validation vulnerability in Apache Traffic Server header parsing allowing HTTP request smuggling. Affected versions: 8.0.0–8.1.2 and 9.0.0–9.0.1. Debian advisories map fixes to 8.0.2+ds-1+deb10u6 and 8.1.1+ds-1.1+deb11u1 (Bullseye/Buster), while OpenVAS/Nessus ...

CVE-2023-33933

Apache Traffic Server (OSS reverse/forward proxy) is affected by CVE-2023-33933, impacting versions 8.0.0 through 9.2.0. The issue is described as Exposure of Sensitive Information to an Unauthorized Actor, with impact confined to confidentiality (C: High, I: None, A: None) and no user interactio...

CVE-2021-32567

CVE-2021-32567 is an HTTP/2 input-validation vulnerability in Apache Traffic Server that can cause denial of service. Affected are ATS versions 7.0.0–7.1.12, 8.0.0–8.1.1, and 9.0.0–9.0.1. The core issue is improper input validation in HTTP/2 handling, leading to server DOS conditions. The connect...

CVE-2022-31779

CVE-2022-31779 affects Apache Traffic Server, where an improper input validation in HTTP/2 header parsing allows request smuggling. Affected: ATS 8.0.0–9.1.2. Impact: potential inconsistency or compromise via crafted requests (I: HIGH, A: NONE, C: NONE). Mitigation in public advisories: Debian fi...

CVE-2021-37150

CVE-2021-37150 affects Apache Traffic Server 8.0.0–9.1.2. It is due to improper input validation in header parsing, allowing an attacker to request secure resources. The issue is rated HIGH (CVSS/CA: HIGH; I/N/A impacts as documented). Remediation shown in connected advisories: upgrade to newer T...

CVE-2024-56195

Apache Traffic Server is vulnerable to an improper access control issue in the TSHttpTxnIntercept() function. This deficiency allows a remote attacker to bypass security controls and gain unauthorized access to protected information . The vulnerability affects versions 9.2.0 through 9.2.8 and 10....

CVE-2014-3624

CVE-2014-3624 affects Apache Traffic Server (ATS) 5.1.x before 5.1.1 . The issue is a failure to properly tunnel remap requests using CONNECT , allowing remote attackers to bypass access restrictions. Root cause described as improper handling of CONNECT tunneling for remap requests. Impact is byp...

CVE-2022-37392

CVE-2022-37392 is an Apache Traffic Server vulnerability described as an improper check for unusual or exceptional conditions in request handling, affecting versions 8.0.0–9.1.2. Public advisories (Debian DSA-5311, DLA-3385) and Nessus plugins state that exploitation could lead to HTTP request sm...

CVE-2015-5168

CVE-2015-5168 is an unspecified vulnerability in the HTTP/2 experimental feature of Apache Traffic Server 5.3.x before 5.3.2. The connected documents consistently describe it as having unknown impact and attack vectors, distinct from CVE-2015-5206. Affected product: Apache Traffic Server; affecte...

CVE-2017-5660

CVE-2017-5660 affects Apache Traffic Server (ATS) versions 6.2.0 and earlier and 7.0.0 and earlier due to a Host header/line folding issue that can interact with upstream proxies and cause the wrong host to be used. Several sources describe an input-validation/host-header vulnerability with poten...

CVE-2026-33267

CVE-2026-33267 is an Improper Input Validation vulnerability in Apache Traffic Server. Affected are ATS 9.2.0–9.2.14 and 10.1.0–10.1.3; patch versions are 9.2.15 and 10.1.4. CVSS data from sources indicates Network-based, high-severity impact (CVSSv3.1: base score 10.0, Confidentiality/Integrity ...

CVE-2022-32749

CVE-2022-32749 is an Apache Traffic Server vulnerability described as an improper check for unusual or exceptional conditions that can crash the server under certain requests. Affected products span Traffic Server 8.0.0 through 9.1.3. The connected documents indicate that Debian and Fedora adviso...

CVE-2021-38161

Apache Traffic Server (ATS) is affected by CVE-2021-38161: an improper TLS origin verification authentication vulnerability in ATS 8.0.0–8.0.8 that enables MITM attacks. The issue is rooted in TLS origin verification, allowing an attacker to intercept or manipulate traffic between clients and ATS...

CVE-2018-8005

CVE-2018-8005 affects Apache Traffic Server (ATS). When a range request contains multiple ranges, ATS reads the entire object from cache, causing potential performance degradation for large cached objects. Affected versions are 6.0.0–6.2.2 and 7.0.0–7.1.3. Mitigation: upgrade to 6.2.3 or later fo...

CVE-2018-8040

CVE-2018-8040 affects Apache Traffic Server (ATS) via the ESI plugin. Pages rendered with ESI can access the cookie header even when access is disallowed, impacting ATS versions 6.0.0–6.2.2 and 7.0.0–7.1.3. The root cause is improper restriction of cookie header access within the ESI plugin, lead...

CVE-2026-58178

The vulnerability CVE-2026-58178 affects the Apache Traffic Server ESI plugin, where unbounded recursion can lead to server-side request forgery by fetching attacker-controlled URLs. Affected versions are 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. The issue is caused by uncontrolled recursion ...

CVE-2012-0256

Apache Traffic Server is affected by CVE-2012-0256 due to a heap memory allocation bug that can be triggered by a long HTTP Host header, enabling a remote attacker to cause a DoS (daemon crash). Affected versions are 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3. The issue is a heap-based v...

CVE-2026-22068

Apache Traffic Server is affected by a Regular Expression without Anchors vulnerability (CVE-2026-22068). Affected versions are 10.0.x through 10.1.3 and 9.0.x through 9.2.14. The issue is addressed in versions 9.2.15 and 10.1.4. Exploitation status is not provided in the documents. CVSS data is ...

CVE-2026-57834

Summary: Apache Traffic Server is affected by a vulnerability where request smuggling is possible when chunked messages are malformed. This affects versions 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. The issue is fixed in 9.2.15 and 10.1.4. Impact indicators in the sources show high severity (...

CVE-2021-37149

CVE-2021-37149: Improper input validation in Apache Traffic Server header parsing allows request smuggling. Affected: ATS versions 8.0.0–8.1.2 and 9.0.0–9.1.0. The issue is mitigated by upgrading to patched releases (e.g., 8.1.3 or 9.1.1 per sources). If upgrading is not feasible, refer to vendor...

CVE-2014-3525

CVE-2014-3525 affects Apache Traffic Server 3.x (up to 3.2.5), 4.x before 4.2.1.1, and 5.x before 5.0.1. The connected sources describe an unspecified vulnerability related to synthetic health checks that can lead to DoS. Public details are limited in the provided docs; some entries reference upd...

CVE-2015-3249

The CVE-2015-3249 entry concerns Apache Traffic Server (ATS) 5.3.x prior to 5.3.1, where the HTTP/2 experimental feature is vulnerable. The underlying issue affects the frame_handlers array and the set_dynamic_table_size function, enabling remote attackers to cause a denial of service (out-of-bou...

CVE-2021-41585

This CVE (CVE-2021-41585) affects Apache Traffic Server versions 5.0.0–9.1.0 and is caused by improper input validation in accepting socket connections, enabling an attacker to cause the server to stop accepting new connections. The issue is corroborated across multiple sources (OSV- entries, CNV...

CVE-2026-59173

Apache Traffic Server is vulnerable to an uncontrolled resource consumption issue, specifically a DoS vulnerability in HTTP/2 via stalled flow-control . This affects versions 9.0.0 through 9.1.13 and 10.0.0 through 10.1.2 . Users are recommended to upgrade to version 9.1.14 or 10.1.3 to resolve t...

CVE-2025-31698

A deficiency in access control exists in Apache Traffic Server versions 10.0.0 through 10.0.6 and 9.0.0 through 9.2.10 . The vulnerability stems from an ACL configuration in ip_allow.config or remap.config that fails to utilize IP addresses provided by the PROXY protocol . This could allow a mali...

CVE-2017-5659

CVE-2017-5659 affects Apache Traffic Server prior to 6.2.1. The vulnerability triggers a coredump when there is a mismatch between content length and chunked encoding. Impact in sources notes crash/denial of service-like behavior (availability impact) with a potential high consequence. The docume...

CVE-2026-58151

Apache Traffic Server is affected by CVE-2026-58151, where abusive HTTP/2 framing and flow-control can exhaust resources or crash the server. Affected builds: 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Upgrading to fixed releases 9.2.15 or 10.1.4 is recommended. The CVSS details provided indic...

CVE-2015-5206

Apache Traffic Server: Unspecified vulnerability in the HTTP/2 experimental feature affects 5.3.x before 5.3.2. Root cause and impact are not detailed in the provided descriptions; CVSS metrics indicate high severity with network access. Remediation per connected records is upgrade to 5.3.2 or la...

CVE-2025-65114

Apache Traffic Server is vulnerable to HTTP request smuggling when processing malformed chunked messages . This issue affects versions 9.0.0 through 9.2.12 and 10.0.0 through 10.1.1 . The root cause involves incorrect handling within the chunked encoding parser , specifically regarding the prev_i...

CVE-2016-5396

Apache Traffic Server (ATS) versions 6.0.0–6.2.0 are affected by an HPACK Bomb Attack. The CVE notes a network-accessible vulnerability with a high impact on availability (CVSS v3 base score 7.5). The related documents consistently describe HPACK Bomb as the issue; no concrete remediation, patch ...

CVE-2017-7671

CVE-2017-7671 is linked to a TLS handshake DoS in Apache Traffic Server (ATS). The Vulners/EUVD/OpenVAS/Nessus-derived documents confirm: vulnerable ATS versions are 5.2.0–5.3.2, 6.0.0–6.2.0, and 7.0.0, with the issue leading to a server coredump. Public references also show Debian DSAs recommend...

CVE-2014-10022

Apache Traffic Server is affected in versions before 5.1.2. The vulnerability arises from an issue in internal buffer sizing that can allow a remote attacker to cause a denial of service. Affected component is the HTTP handling path (HttpTransact.cc as cited in multiple sources) and the root caus...

CVE-2026-58150

Summary: Apache Traffic Server is vulnerable to HTTP/2 downgrade request smuggling because it does not reject Transfer-Encoding in HTTP/2 requests. Affected versions: 8.0.0–8.1.9, 9.0.0–9.2.14, 10.0.0–10.1.3. Impact: Verified issue exists; CVSS metrics indicate HIGH severity with network attack v...

CVE-2018-9481

CVE-2018-9481 : The vulnerability is in the Bluetooth stack, specifically in the function bta_hd_set_report_act of bta_hd_act.cc. An integer overflow can trigger an out-of-bounds read, enabling remote information disclosure through the Bluetooth service without extra privileges or user interactio...

CVE-2026-24033

The CVE-2026-24033 issue affects Apache Traffic Server (versions 10.0.0–10.1.3 and 9.0.0–9.2.14) and is due to HTTP Request/Response Smuggling from chunked extension quoted-string parsing. The vulnerability could enable request smuggling via crafted HTTP requests, with the fix being upgrade to 9....

CVE-2010-2952

Apache Traffic Server vulnerable in versions before 2.0.1 and in 2.1.x before 2.1.2-unstable. The issue stems from improper DNS source port/transaction ID handling and DNS query field validation, enabling MITM-style cache poisoning via crafted responses. Remediation: upgrade to Apache Traffic Ser...

CVE-2026-58154

CVE-2026-58154 concerns Apache Traffic Server, where memory-safety errors occur during MIME and HTTP header parsing, allowing out-of-bounds writes or integer overflows. Affected releases: 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Impacted components are parsing code paths for MIME and headers...

CVE-2026-58155

Apache Traffic Server is affected by CVE-2026-58155 due to header-name length truncation that can enable header aliasing, request smuggling, and policy bypass. Affected versions are 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Upgrading to 9.2.15 or 10.1.4 is recommended to fix the issue. The pr...

CVE-2018-8022

CVE-2018-8022 affects Apache Traffic Server (ATS) 6.2.2. A specially crafted invalid TLS handshake can cause ATS to segfault, leading to a partial availability impact (DoS) as described in multiple sources. The concrete vulnerable component is the TLS handshake handling within ATS; the root cause...

CVE-2026-58160

CVE-2026-58160 affects Apache Traffic Server. The issue is described as out-of-bounds reads when parsing DNS responses, impacting versions 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. The documented remediation is to upgrade to 9.2.15 or 10.1.4, which fix the issue. No exploitation details or ad...

CVE-2026-58153

CVE-2026-58153 affects Apache Traffic Server (versions 10.0.0 through 10.1.3). The issue arises when converting HTTP/2 to HTTP/1: origin trailers are forwarded to HTTP/1 clients without proper chunked framing. This can lead to unsafe trailer handling during protocol translation. Remediation: upgr...

CVE-2025-58136

A bug in POST request handling within Apache Traffic Server can cause a crash under certain conditions. This vulnerability affects versions 10.0.0 through 10.1.1 and 9.0.0 through 9.2.12 . The issue is resolved in versions 10.1.2 and 9.2.13 . For older versions, a workaround is available by setti...

CVE-2026-58159

Apache Traffic Server is affected by a vulnerability in Listener and ACL handling that allows bypass of IP access controls on UDS listeners and via ACL matching errors. Affected versions: 8.0.0–8.1.9, 9.0.0–9.2.14, 10.0.0–10.1.3. Fixed in 9.2.15 and 10.1.4. If exploiting details are not provided ...

CVE-2026-58189

CVE-2026-58189 affects Apache Traffic Server 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. The flaw arises when plugins reset the redirect retry counter, bypassing redirect limits and enabling SSRF amplification. Upgrade to 9.2.15 or 10.1.4 to fix the issue.

CVE-2026-58161

Apache Traffic Server is affected by memory-safety issues in TLS and SNI handling that can crash the server due to null dereferences and dangling references. Affects releases 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Mitigation is to upgrade to 9.2.15 or 10.1.4, which fix the issue. The CVE e...

CVE-2026-58156

Apache Traffic Server contains a URL/userinfo port parsing flaw that allows port-based access-control bypass in versions 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. The issue is triggered by mis-parsing ports in URLs and userinfo, enabling bypass of access controls. Upgraded fixes are available...

CVE-2026-58187

CVE-2026-58187 affects the Apache Traffic Server multiplexer plugin. The issue overruns the plugin’s chunk-decode buffer using upstream input, enabling a denial of service. Affected versions are 8.0.0–8.1.9, 9.0.0–9.2.14, and 10.0.0–10.1.3. Apache recommends upgrading to 9.2.15 or 10.1.4, which c...