{"kind": "product", "path": "vulns/ubuntu-24.04-lts/trafficserver", "name": "trafficserver", "product": "trafficserver", "ecosystem": "Ubuntu:24.04:LTS", "items": [{"id": "CVE-2026-112381", "noindex": false, "published": "2026-10-21T19:20:38.885Z", "modified": "2026-10-23T21:20:44.000Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0035, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-112381", "title": "Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response", "description": "Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports.\n\n\n\nThis issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-112381"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111817", "noindex": false, "published": "2026-10-21T19:20:00.515Z", "modified": "2026-10-23T21:21:06.850Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00359, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111817", "title": "Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout", "description": "Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled.\n\n\n\nThis issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111817"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111812", "noindex": false, "published": "2026-10-21T19:18:19.526Z", "modified": "2026-10-23T11:06:21.577Z", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "severity": "high", "epss": 0.00361, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111812", "title": "Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials", "description": "Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111812"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111811", "noindex": false, "published": "2026-10-21T19:17:32.448Z", "modified": "2026-10-23T11:06:21.737Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H", "severity": "critical", "epss": 0.00356, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111811", "title": "Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication", "description": "Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111811"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111809", "noindex": false, "published": "2026-10-21T19:16:16.439Z", "modified": "2026-10-21T19:16:16.439Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N", "severity": "medium", "epss": 0.00218, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111809", "title": "Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling", "description": "Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111809"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111810", "noindex": false, "published": "2026-10-21T19:14:50.479Z", "modified": "2026-10-23T21:21:35.176Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0036, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111810", "title": "Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service", "description": "Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.\n\n\n\nThis issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111810"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111815", "noindex": false, "published": "2026-10-21T19:13:55.811Z", "modified": "2026-10-23T11:06:21.881Z", "cvss": 7.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "severity": "high", "epss": 0.00235, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111815", "title": "Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement", "description": "Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111815"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111814", "noindex": false, "published": "2026-10-21T19:13:06.888Z", "modified": "2026-10-23T11:06:22.026Z", "cvss": 7.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N", "severity": "high", "epss": 0.00235, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111814", "title": "Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin", "description": "Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one.\n\n\n\nThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111814"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111808", "noindex": false, "published": "2026-10-21T19:11:59.516Z", "modified": "2026-10-23T21:22:09.150Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H", "severity": "high", "epss": 0.00412, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111808", "title": "Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion", "description": "Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111808"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111805", "noindex": false, "published": "2026-10-21T19:10:46.319Z", "modified": "2026-10-23T21:22:42.961Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H", "severity": "high", "epss": 0.00412, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111805", "title": "Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion", "description": "Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111805"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111816", "noindex": false, "published": "2026-10-21T18:26:32.566Z", "modified": "2026-10-23T21:22:57.204Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N", "severity": "critical", "epss": 0.00308, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111816", "title": "Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out", "description": "Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111816"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2025-55702", "noindex": false, "published": "2026-10-21T18:24:21.377Z", "modified": "2026-10-23T11:06:22.172Z", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "severity": "high", "epss": 0.00325, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-55702", "title": "Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request", "description": "When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2025-55702"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2025-31699", "noindex": false, "published": "2026-10-21T18:22:28.383Z", "modified": "2026-10-23T11:06:22.325Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:H/SI:H/SA:L", "severity": "critical", "epss": 0.00348, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-31699", "title": "Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling", "description": "Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2025-31699"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111804", "noindex": false, "published": "2026-10-21T18:21:32.055Z", "modified": "2026-10-23T21:23:16.760Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00298, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111804", "title": "Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs", "description": "Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.\n\n\n\nThis issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111804"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-111813", "noindex": false, "published": "2026-10-21T18:20:22.104Z", "modified": "2026-10-23T11:06:22.469Z", "cvss": 10, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00489, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-111813", "title": "Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration", "description": "Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.", "references": ["https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc", "https://nvd.nist.gov/vuln/detail/CVE-2026-111813"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-102795", "noindex": false, "published": "2026-10-02T17:40:50.648Z", "modified": "2026-10-02T18:30:59.242Z", "cvss": 7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "severity": "high", "epss": 0.00283, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-102795", "title": "Apache Traffic Server: SNI to Host header matching policy is not properly enforced", "description": "Improper Access Control vulnerability in Apache Traffic Server.\n\n\n\nThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.\n\n\n\nUsers are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.\n\n\n\nThis CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.", "references": ["https://lists.apache.org/thread.html/qcxzvcbbln68hd0j08pdnjdj4r991nhd", "https://www.cve.org/CVERecord?id=CVE-2026-41920", "https://nvd.nist.gov/vuln/detail/CVE-2026-102795"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-65100", "noindex": false, "published": "2026-07-29T09:06:17.226Z", "modified": "2026-10-01T17:06:34.984Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "severity": "medium", "epss": 0.0058, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-65100", "title": "Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode", "description": "Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.\n\n\n\nUsers are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.", "references": ["https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d", "https://nvd.nist.gov/vuln/detail/CVE-2026-65100"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-58189", "noindex": false, "published": "2026-07-29T09:05:19.468Z", "modified": "2026-10-01T17:05:54.498Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L", "severity": "high", "epss": 0.00629, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-58189", "title": "Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification", "description": "Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.\n\n\n\nUsers are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.", "references": ["https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d", "https://nvd.nist.gov/vuln/detail/CVE-2026-58189"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-58188", "noindex": false, "published": "2026-07-29T09:04:24.836Z", "modified": "2026-10-01T17:05:39.081Z", "cvss": 8.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00772, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-58188", "title": "Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins", "description": "Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.\n\n\n\nUsers are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.", "references": ["https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d", "https://nvd.nist.gov/vuln/detail/CVE-2026-58188"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}, {"id": "CVE-2026-58187", "noindex": false, "published": "2026-07-29T09:03:22.659Z", "modified": "2026-10-01T17:05:24.712Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00584, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-58187", "title": "Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service", "description": "The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.\n\n\n\nUsers are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.", "references": ["https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d", "https://nvd.nist.gov/vuln/detail/CVE-2026-58187"], "fixes": [], "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}]}], "total": 70, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "trafficserver", "path": "vulns/ubuntu-24.04-lts/trafficserver", "ecosystem": "Ubuntu:24.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 16, "kev": 0}, "lastmod": "2026-10-23T21:23:16.760Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}