p PatchFirst

PatchFirst · Latest vulnerabilities

trafficserver vulnerabilities · Page 2

Vulnerabilities published for trafficserver in the last 30 days: 16. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 134

  1. CVE-2026-58186

    High · CVSS 8.2EPSS 0.7%No fix published

    Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

    The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-58185

    High · CVSS 8.2EPSS 0.58%No fix published

    Apache Traffic Server: Use-after-free in the intercept plugin

    The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-58184

    High · CVSS 8.3EPSS 0.59%No fix published

    Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory

    The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-58183

    High · CVSS 8.2EPSS 0.66%No fix published

    Apache Traffic Server: prefetch plugin can crash on attacker-influenced input

    The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-58182

    High · CVSS 8.2EPSS 0.73%No fix published

    Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

    The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2026-58181

    High · CVSS 8.2EPSS 0.66%No fix published

    Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash

    The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2026-58180

    High · CVSS 8.2EPSS 0.66%No fix published

    Apache Traffic Server: txn_box plugin overflows the stack from attacker input

    The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2026-58179

    Critical · CVSS 9.2EPSS 0.6%No fix published

    Apache Traffic Server: regex_remap plugin overflows the stack from attacker input

    The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2026-58178

    High · CVSS 8.2EPSS 0.66%No fix published

    Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

    The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2026-58177

    High · CVSS 8.3EPSS 0.59%No fix published

    Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework

    The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2026-58175

    High · CVSS 8.2EPSS 0.66%No fix published

    Apache Traffic Server: HostDB SRV handling leaks memory

    Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2026-58164

    High · CVSS 8.3EPSS 0.66%No fix published

    Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free

    Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2026-58163

    High · CVSS 8.3EPSS 0.7%No fix published

    Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

    Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2026-58162

    High · CVSS 8.4EPSS 0.36%No fix published

    Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates

    The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2026-58161

    Critical · CVSS 9.2EPSS 0.66%No fix published

    Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

    Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2026-58160

    Medium · CVSS 6.3EPSS 0.58%No fix published

    Apache Traffic Server: Out-of-bounds reads while parsing DNS responses

    Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  17. CVE-2026-58159

    High · CVSS 7EPSS 0.56%No fix published

    Apache Traffic Server: Listener and ACL handling allow access-control bypass

    Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2026-58158

    High · CVSS 8.2EPSS 0.58%No fix published

    Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow

    Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2026-58157

    Medium · CVSS 6.9EPSS 0.48%No fix published

    Apache Traffic Server: Improper server-session reuse can expose data across client connections

    Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2026-58156

    Medium · CVSS 6.3EPSS 0.39%No fix published

    Apache Traffic Server: URL and port parsing errors allow access-control bypass

    Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

    trafficserverOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →