Traffic Server Security Vulnerabilities and Issues — Traffic Server CVE List

Lucene search

ApacheTraffic Server

7 matches found

CVE•added 2025/04/03 9:15 a.m.•373 views

CVE-2024-53868

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issue.

7.5CVSS7.2AI score0.0023EPSS

CVE•added 2025/03/06 12:15 p.m.•62 views

CVE-2024-38311

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

6.3CVSS7.1AI score0.0024EPSS

CVE•added 2025/03/06 11:15 a.m.•57 views

CVE-2024-56202

Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue.

4.3CVSS7.1AI score0.00196EPSS

CVE•added 2025/03/06 12:15 p.m.•55 views

CVE-2024-56195

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

6.3CVSS7.1AI score0.00163EPSS

CVE•added 2025/03/06 12:15 p.m.•45 views

CVE-2024-56196

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 10.0.4, which fixes the issue.

6.3CVSS7.1AI score0.00131EPSS

CVE•added 2025/06/19 10:15 a.m.•37 views

CVE-2025-49763

ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it.This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, f...

7.5CVSS6.5AI score0.00296EPSS

CVE•added 2025/06/19 10:15 a.m.•18 views

CVE-2025-31698

ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol. This issue affect...

7.5CVSS6.5AI score0.00098EPSS