p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de trafficserver

Vulnerabilidades publicadas para trafficserver en los últimos 30 días: 16. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 134

  1. CVE-2026-112381

    Alta · CVSS 8.2EPSS 0,26%Sin corrección publicada

    Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response

    Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  2. CVE-2026-111817

    Media · CVSS 6.9EPSS 0,26%Sin corrección publicada

    Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout

    Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled. This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  3. CVE-2026-111812

    Alta · CVSS 7EPSS 0,26%Sin corrección publicada

    Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials

    Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  4. CVE-2026-111811

    Crítica · CVSS 9.4EPSS 0,26%Sin corrección publicada

    Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication

    Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  5. CVE-2026-111809

    Media · CVSS 6.9EPSS 0,22%Sin corrección publicada

    Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling

    Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  6. CVE-2026-111810

    Alta · CVSS 8.7EPSS 0,26%Sin corrección publicada

    Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service

    Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  7. CVE-2026-111815

    Alta · CVSS 7.8EPSS 0,17%Sin corrección publicada

    Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement

    Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  8. CVE-2026-111814

    Alta · CVSS 7.8EPSS 0,17%Sin corrección publicada

    Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin

    Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  9. CVE-2026-111808

    Alta · CVSS 7.7EPSS 0,32%Sin corrección publicada

    Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion

    Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  10. CVE-2026-111805

    Alta · CVSS 7.7EPSS 0,32%Sin corrección publicada

    Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion

    Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  11. CVE-2026-111816

    Crítica · CVSS 9.2EPSS 0,24%Sin corrección publicada

    Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out

    Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  12. CVE-2025-55702

    Alta · CVSS 7EPSS 0,25%Sin corrección publicada

    Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request

    When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  13. CVE-2025-31699

    Crítica · CVSS 9.1EPSS 0,27%Sin corrección publicada

    Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling

    Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  14. CVE-2026-111804

    Alta · CVSS 8.8EPSS 0,23%Sin corrección publicada

    Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs

    Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  15. CVE-2026-111813

    Crítica · CVSS 10EPSS 0,35%Sin corrección publicada

    Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration

    Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  16. CVE-2026-102795

    Alta · CVSS 7EPSS 0,28%Sin corrección publicada

    Apache Traffic Server: SNI to Host header matching policy is not properly enforced

    Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  17. CVE-2026-65100

    Media · CVSS 6.3EPSS 0,58%Sin corrección publicada

    Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

    Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  18. CVE-2026-58189

    Alta · CVSS 8.2EPSS 0,63%Sin corrección publicada

    Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

    Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  19. CVE-2026-58188

    Alta · CVSS 8.4EPSS 0,77%Sin corrección publicada

    Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

    Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  20. CVE-2026-58187

    Media · CVSS 6.3EPSS 0,58%Sin corrección publicada

    Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service

    The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverSistemas operativos
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →