CVE Intelligence

Apache Software Foundation Traffic Server vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Apache Software Foundation Traffic Server: 43 record(s), with affected versions and fixes.
cpe:2.3:a:apache:traffic_server

CVE-2026-65324 High · 7.5 CWE-400 Jul 29, 2026
Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58156 Medium · 4.9 CWE-863 Jul 29, 2026
Apache Traffic Server: URL and port parsing errors allow access-control bypass
Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58155 Critical · 9.3 CWE-444 Jul 29, 2026
Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58154 High · 8.9 CWE-787 Jul 29, 2026
Apache Traffic Server: Memory-safety errors in MIME and header parsing
Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58153 High · 8.3 CWE-444 Jul 29, 2026
Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58152 Medium · 5.9 CWE-190 Jul 29, 2026
Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory
Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58151 High · 7.5 CWE-400 Jul 29, 2026
Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server
Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58150 Critical · 10.0 CWE-444 Jul 29, 2026
Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-57834 Critical · 10.0 CWE-444 Jul 29, 2026
Apache Traffic Server: Malformed chunked message body allows request smuggling
Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-41920 Critical · 9.3 CWE-284 Jul 29, 2026
Apache Traffic Server: SNI to Host header matching policy is not properly enforced
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.
CVE-2026-33930 Medium · 5.9 CWE-121 Jul 29, 2026
Apache Traffic Server: Buffer overflow via Host field that has a long string value
Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-33267 Critical · 9.1 CWE-20 Jul 29, 2026
Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
CVE-2026-24033 Medium · 5.3 CWE-444 Jul 29, 2026
Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
CVE-2026-22068 Medium · 5.3 CWE-777 Jul 29, 2026
Apache Traffic Server: Regex mappings match with malicious domain names
Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
CVE-2026-59173 High · 7.5 CWE-400 Jul 18, 2026
Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions
Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2. Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue.
CVE-2025-65114 High · 7.5 CWE-444 Apr 2, 2026
Apache Traffic Server: Malformed chunked message body allows request smuggling
Apache Traffic Server allows request smuggling if chunked messages are malformed.  This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1. Users are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue.
CVE-2025-58136 High · 7.5 CWE-670 Apr 2, 2026
Apache Traffic Server: A simple legitimate POST request causes a crash
A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).
CVE-2023-44487 High · 7.5 KEV Urgent · 73 Public exploit CWE-400 Oct 10, 2023
HTTP/2 Rapid Reset Attack Vulnerability
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.