Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand auszulösen sowie Daten zu manipulieren oder offenzulegen.
Product
Apache Traffic Server ist ein skalier- und erweiterbarer, mit HTTP/1.1 kompatibler "caching proxy server".
Vulnerabilities 15
-
Critical 10.0
Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0…
-
Critical 10.0
Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, fr…
-
Critical 10.0
Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.…
-
Critical 10.0
Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 throu…
-
Critical 9.3
Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are reco…
-
Critical 9.3
Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, a…
-
Critical 9.0
Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1…
-
High 8.9
Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request o…
-
High 8.7
Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections t…
-
High 8.6
Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. User…
-
High 8.6
Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users a…
-
High 8.2
Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. …
-
High 7.5
Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apa…
-
Medium 5.9
Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-…
-
Medium 5.3
Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on…
Revision history
-
#2
Korrektur
-
#1
Initiale Fassung
References
-
Apache Mailing List vom 2026-10-21
https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc