AT
Product
Apache Traffic Server
77
CVEs
0
On KEV
10.0
Max CVSS
16
New 30D
Severity mix
Critical 19High 43Medium 15Low 0
Watch
Add Apache Traffic Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-53868 | 7.5 | Apr 3 | Apache Traffic Server: Malformed chunked message body allows request smuggling Affected: 9.2.0 through 9.2.9; 10.0.0 through 10.0.4 |
| CVE-2024-50305 | 7.5 | Nov 14 | Apache Traffic Server: Valid Host field value can cause crashes Affected: 9.2.0 through 9.2.5 |
| CVE-2024-38479 | 7.5 | Nov 14 | Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.5 |
| CVE-2023-38522 | 7.5 | Jul 26 | Apache Traffic Server: Incomplete field name check allows request smuggling Affected: 8.0.0 through 8.1.10; 9.0.0 through 9.2.4 |
| CVE-2024-35161 | 7.5 | Jul 26 | Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling Affected: 8.0.0 through 8.1.10; 9.0.0 through 9.2.4 |
| CVE-2022-31779 | 7.5 | Aug 10 | Improper HTTP/2 scheme and method validation Affected: 8.0.0 to 9.1.2 |
| CVE-2022-25763 | 7.5 | Aug 10 | Improper input validation on HTTP/2 headers Affected: 8.0.0 to 9.1.2 |
| CVE-2022-31778 | 7.5 | Aug 10 | Transfer-Encoding not treated as hop-by-hop Affected: 8.0.0 to 9.0.2 |
| CVE-2022-31780 | 7.5 | Aug 10 | HTTP/2 framing vulnerabilities Affected: 8.0.0 to 9.1.2 |
| CVE-2022-28129 | 7.5 | Aug 10 | Insufficient Validation of HTTP/1.x Headers Affected: 8.0.0 to 9.1.2 |
| CVE-2021-37150 | 7.5 | Aug 10 | Protocol vs scheme mismatch Affected: 8.0.0 to 9.1.2 |
| CVE-2018-11783 | 7.5 | Mar 7 | sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin Affected: Apache Traffic Server 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, 8.0.0 to 8.0.1 |
| CVE-2026-58160 | 6.5 | Jul 29 | Apache Traffic Server: Out-of-bounds reads while parsing DNS responses Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2024-38311 | 6.3 | Mar 6 | Apache Traffic Server: Request smuggling via pipelining after a chunked message body Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.8; 10.0.0 through 10.0.3 |
| CVE-2024-56195 | 6.3 | Mar 6 | Apache Traffic Server: Intercept plugins are not access controlled Affected: 9.2.0 through 9.2.8; 10.0.0 through 10.0.3 |
| CVE-2024-56196 | 6.3 | Mar 6 | Apache Traffic Server: ACL is not fully compatible with older versions Affected: 10.0.0 through 10.0.3 |
| CVE-2026-112381 | 5.9 | Oct 21 | Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response Affected: 9.2.15; 10.1.4; 10.2.0 |
| CVE-2026-58158 | 5.9 | Jul 29 | Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-58152 | 5.9 | Jul 29 | Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-33930 | 5.9 | Jul 29 | Apache Traffic Server: Buffer overflow via Host field that has a long string value Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-111817 | 5.3 | Oct 21 | Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout Affected: 8.1.11; 9.2.5 through 9.2.15; 10.0.0 through 10.1.4; 10.2.0 |
| CVE-2026-24033 | 5.3 | Jul 29 | Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing Affected: 10.0.0 through 10.1.3; 9.0.0 through 9.2.14 |
| CVE-2026-22068 | 5.3 | Jul 29 | Apache Traffic Server: Regex mappings match with malicious domain names Affected: 10.0.x through 10.1.3; 9.0.x through 9.2.14 |
| CVE-2026-58156 | 4.9 | Jul 29 | Apache Traffic Server: URL and port parsing errors allow access-control bypass Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-65100 | 4.8 | Jul 29 | Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-65325 | 4.8 | Jul 29 | Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification Affected: 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2024-56202 | 4.3 | Mar 6 | Apache Traffic Server: Expect header field can unreasonably retain resource Affected: 9.0.0 through 9.2.8; 10.0.0 through 10.0.3 |