p PatchFirst

PatchFirst · Latest vulnerabilities

trafficserver vulnerabilities

Vulnerabilities published for trafficserver in the last 30 days: 16. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 134

  1. CVE-2026-112381

    High · CVSS 8.2EPSS 0.26%No fix published

    Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response

    Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-111817

    Medium · CVSS 6.9EPSS 0.26%No fix published

    Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout

    Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled. This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-111812

    High · CVSS 7EPSS 0.26%No fix published

    Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials

    Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-111811

    Critical · CVSS 9.4EPSS 0.26%No fix published

    Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication

    Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-111809

    Medium · CVSS 6.9EPSS 0.22%No fix published

    Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling

    Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-111810

    High · CVSS 8.7EPSS 0.26%No fix published

    Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service

    Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-111815

    High · CVSS 7.8EPSS 0.17%No fix published

    Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement

    Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-111814

    High · CVSS 7.8EPSS 0.17%No fix published

    Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin

    Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-111808

    High · CVSS 7.7EPSS 0.32%No fix published

    Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion

    Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2026-111805

    High · CVSS 7.7EPSS 0.32%No fix published

    Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion

    Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2026-111816

    Critical · CVSS 9.2EPSS 0.24%No fix published

    Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out

    Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2025-55702

    High · CVSS 7EPSS 0.25%No fix published

    Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request

    When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2025-31699

    Critical · CVSS 9.1EPSS 0.27%No fix published

    Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling

    Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2026-111804

    High · CVSS 8.8EPSS 0.23%No fix published

    Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs

    Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2026-111813

    Critical · CVSS 10EPSS 0.35%No fix published

    Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration

    Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2026-102795

    High · CVSS 7EPSS 0.28%No fix published

    Apache Traffic Server: SNI to Host header matching policy is not properly enforced

    Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue. This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2026-65100

    Medium · CVSS 6.3EPSS 0.58%No fix published

    Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

    Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2026-58189

    High · CVSS 8.2EPSS 0.63%No fix published

    Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

    Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2026-58188

    High · CVSS 8.4EPSS 0.77%No fix published

    Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

    Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2026-58187

    Medium · CVSS 6.3EPSS 0.58%No fix published

    Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service

    The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →