Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, einen Denial-of-Service auszulösen und potentiell eine Codeausführung zu erreichen.
Product
Apache Traffic Server ist ein skalier- und erweiterbarer, mit HTTP/1.1 kompatibler "caching proxy server".
Vulnerabilities 38
-
Critical 10.0CVE-2026-33267 Public exploit
Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
-
Critical 10.0
Apache Traffic Server: Malformed chunked message body allows request smuggling
Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or…
-
Critical 10.0
Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended…
-
Critical 10.0
Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates
The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upg…
-
Critical 9.3
Apache Traffic Server: SNI to Host header matching policy is not properly enforced
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.
-
Critical 9.3
Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recom…
-
High 8.9
Apache Traffic Server: Memory-safety errors in MIME and header parsing
Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrad…
-
High 8.7
Apache Traffic Server: Improper server-session reuse can expose data across client connections
Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended …
-
High 8.6
Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors
The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to …
-
High 8.3
Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 o…
-
High 8.2
Apache Traffic Server: Regex mappings match with malicious domain names
Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
-
High 8.2
Apache Traffic Server: Listener and ACL handling allow access-control bypass
Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade …
-
High 8.2
Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory
The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users…
-
High 8.2
Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins
Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to vers…
-
High 8.1
Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework
The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue.
-
High 8.1
Apache Traffic Server: regex_remap plugin overflows the stack from attacker input
The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade…
-
High 7.5
Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server
Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended…
-
High 7.5
Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrad…
-
High 7.5
Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgr…
-
High 7.5
Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free
Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to…
-
High 7.5
Apache Traffic Server: HostDB SRV handling leaks memory
Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whic…
-
High 7.5
Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to …
-
High 7.5
Apache Traffic Server: txn_box plugin overflows the stack from attacker input
The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to versio…
-
High 7.5
Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash
The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to up…
-
High 7.5
Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses
The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to…
-
High 7.5
Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification
Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recomme…
-
High 7.5
Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through …
-
High 7.2
Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to versi…
-
Medium 6.5
Apache Traffic Server: Out-of-bounds reads while parsing DNS responses
Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, whic…
-
Medium 5.9
Apache Traffic Server: Buffer overflow via Host field that has a long string value
Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled. This issue affects Apache Traffic Server: from 8.0…
-
Medium 5.9
Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory
Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to ve…
-
Medium 5.9
Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow
Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to …
-
Medium 5.9
Apache Traffic Server: prefetch plugin can crash on attacker-influenced input
The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to vers…
-
Medium 5.9
Apache Traffic Server: Use-after-free in the intercept plugin
The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi…
-
Medium 4.9
Apache Traffic Server: URL and port parsing errors allow access-control bypass
Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrad…
-
Medium 4.8
Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue…
-
Medium 4.8
Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification
Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended…
-
Low 3.7
Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service
The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are …
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-50225
-
#1
Initiale Fassung
References
-
Apache Traffic Server vulnerabilities vom 2026-07-28
https://lists.apache.org/thread/5prl9glcm9g2swnq9hqxvnokylm1gr6d
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-22068
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-24033
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-33267
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-33930
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-41920
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-57834
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58150
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58151
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58152
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58153
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58154
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58155
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58156
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58157
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58158
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58159
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58160
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58161
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58162
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58163
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58164
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58175
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58177
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58178
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58179
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58180
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58181
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58182
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58183
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58184
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58185
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58186
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58187
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58188
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-58189
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-65100
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-65324
-
CVE Record vom 2026-07-28
https://www.cve.org/CVERecord?id=CVE-2026-65325