# Apache Software Foundation Apache Traffic Server.

Every CVE that names Apache Software Foundation Apache Traffic Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Apache Traffic Server: Request smuggling via pipelining after a chunked message body](https://agentprime.io/advisories/CVE-2024-38311.md)
  `CVE-2024-38311` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 6.3 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: CWE-20
- [Apache Traffic Server: Intercept plugins are not access controlled](https://agentprime.io/advisories/CVE-2024-56195.md)
  `CVE-2024-56195` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 6.3 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: Broken access control
- [Apache Traffic Server: ACL is not fully compatible with older versions](https://agentprime.io/advisories/CVE-2024-56196.md)
  `CVE-2024-56196` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 6.3 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: Broken access control
- [Apache Traffic Server: Expect header field can unreasonably retain resource](https://agentprime.io/advisories/CVE-2024-56202.md)
  `CVE-2024-56202` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 4.3 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: CWE-440
- [Apache Traffic Server: Server process can fail to drop privilege](https://agentprime.io/advisories/CVE-2024-50306.md)
  `CVE-2024-50306` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-252
- [Apache Traffic Server: Valid Host field value can cause crashes](https://agentprime.io/advisories/CVE-2024-50305.md)
  `CVE-2024-50305` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 14 Nov 2024 · Tags: Memory corruption, CWE-20
- [Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack](https://agentprime.io/advisories/CVE-2024-38479.md)
  `CVE-2024-38479` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-20
- [Apache Traffic Server: Incomplete field name check allows request smuggling](https://agentprime.io/advisories/CVE-2023-38522.md)
  `CVE-2023-38522` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 26 Jul 2024 · Tags: HTTP request smuggling
- [Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests](https://agentprime.io/advisories/CVE-2024-35296.md)
  `CVE-2024-35296` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 8.2 High · Not analysed yet · Published 26 Jul 2024 · Tags: CWE-20
- [Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling](https://agentprime.io/advisories/CVE-2024-35161.md)
  `CVE-2024-35161` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jul 2024 · Tags: HTTP request smuggling
- [Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack](https://agentprime.io/advisories/CVE-2024-31309.md)
  `CVE-2024-31309` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.95 · Not analysed yet · Published 10 Apr 2024 · Tags: CWE-20
- [Apache Traffic Server: Malformed http/2 frames can cause an abort](https://agentprime.io/advisories/CVE-2023-39456.md)
  `CVE-2023-39456` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.58 · Not analysed yet · Published 17 Oct 2023 · Tags: CWE-20
- [Apache Traffic Server: s3_auth plugin problem with hash calculation](https://agentprime.io/advisories/CVE-2023-41752.md)
  `CVE-2023-41752` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2023 · Tags: Information disclosure
- [Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies](https://agentprime.io/advisories/CVE-2023-33934.md)
  `CVE-2023-33934` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2023 · Tags: HTTP request smuggling
- [Apache Traffic Server: Invalid Range header causes a crash](https://agentprime.io/advisories/CVE-2022-47185.md)
  `CVE-2022-47185` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 9 Aug 2023 · Tags: CWE-20
- [Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work](https://agentprime.io/advisories/CVE-2023-30631.md)
  `CVE-2023-30631` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 14 Jun 2023 · Tags: CWE-20
- [Apache Traffic Server: s3_auth plugin problem with hash calculation](https://agentprime.io/advisories/CVE-2023-33933.md)
  `CVE-2023-33933` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 14 Jun 2023 · Tags: Information disclosure
- [Apache Traffic Server: The TRACE method can be use to disclose network information](https://agentprime.io/advisories/CVE-2022-47184.md)
  `CVE-2022-47184` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 14 Jun 2023 · Tags: Information disclosure
- [Apache Traffic Server: Security issues with the xdebug plugin](https://agentprime.io/advisories/CVE-2022-40743.md)
  `CVE-2022-40743` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 6.1 Medium · Not analysed yet · Published 19 Dec 2022 · Tags: Cross-site scripting (XSS)
- [Apache Traffic Server: Improperly reading the client requests](https://agentprime.io/advisories/CVE-2022-37392.md)
  `CVE-2022-37392` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 5.3 Medium · Not analysed yet · Published 19 Dec 2022 · Tags: CWE-754
- [Apache Traffic Server: Improperly handled requests can cause crashes in specific plugins](https://agentprime.io/advisories/CVE-2022-32749.md)
  `CVE-2022-32749` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 19 Dec 2022 · Tags: CWE-754
- [Improper HTTP/2 scheme and method validation](https://agentprime.io/advisories/CVE-2022-31779.md)
  `CVE-2022-31779` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 10 Aug 2022 · Tags: CWE-20
- [Improper input validation on HTTP/2 headers](https://agentprime.io/advisories/CVE-2022-25763.md)
  `CVE-2022-25763` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 6.8 Medium · Not analysed yet · Published 10 Aug 2022 · Tags: HTTP request smuggling
- [HTTP/2 framing vulnerabilities](https://agentprime.io/advisories/CVE-2022-31780.md)
  `CVE-2022-31780` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 10 Aug 2022 · Tags: CWE-20
- [Transfer-Encoding not treated as hop-by-hop](https://agentprime.io/advisories/CVE-2022-31778.md)
  `CVE-2022-31778` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 10 Aug 2022 · Tags: CWE-20
- [Insufficient Validation of HTTP/1.x Headers](https://agentprime.io/advisories/CVE-2022-28129.md)
  `CVE-2022-28129` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 10 Aug 2022 · Tags: CWE-20
- [Protocol vs scheme mismatch](https://agentprime.io/advisories/CVE-2021-37150.md)
  `CVE-2021-37150` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 4.2 Medium · Not analysed yet · Published 10 Aug 2022 · Tags: CWE-20
- [Improper authentication vulnerability in TLS origin verification](https://agentprime.io/advisories/CVE-2021-44759.md)
  `CVE-2021-44759` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 23 Mar 2022 · Tags: Authentication bypass
- [HTTP request line fuzzing attacks](https://agentprime.io/advisories/CVE-2021-44040.md)
  `CVE-2021-44040` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 23 Mar 2022 · Tags: CWE-20
- [heap-buffer-overflow with stats-over-http plugin](https://agentprime.io/advisories/CVE-2021-43082.md)
  `CVE-2021-43082` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 3 Nov 2021 · Tags: Memory corruption
- [ATS stops accepting connections on FreeBSD](https://agentprime.io/advisories/CVE-2021-41585.md)
  `CVE-2021-41585` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 3 Nov 2021
- [Not validating origin TLS certificate](https://agentprime.io/advisories/CVE-2021-38161.md)
  `CVE-2021-38161` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 3 Nov 2021 · Tags: Authentication bypass
- [Request Smuggling - multiple attacks](https://agentprime.io/advisories/CVE-2021-37149.md)
  `CVE-2021-37149` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 3 Nov 2021 · Tags: CWE-20
- [Request Smuggling - transfer encoding validation](https://agentprime.io/advisories/CVE-2021-37148.md)
  `CVE-2021-37148` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 3 Nov 2021 · Tags: CWE-20
- [Request Smuggling - LF line ending](https://agentprime.io/advisories/CVE-2021-37147.md)
  `CVE-2021-37147` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 3 Nov 2021 · Tags: HTTP request smuggling, CWE-20
- [Dynamic stack buffer overflow in cachekey plugin](https://agentprime.io/advisories/CVE-2021-35474.md)
  `CVE-2021-35474` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 30 Jun 2021 · Tags: Memory corruption
- [Reading HTTP/2 frames too many times](https://agentprime.io/advisories/CVE-2021-32567.md)
  `CVE-2021-32567` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 30 Jun 2021 · Tags: CWE-20
- [Specific sequence of HTTP/2 frames can cause ATS to crash](https://agentprime.io/advisories/CVE-2021-32566.md)
  `CVE-2021-32566` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 30 Jun 2021 · Tags: CWE-20
- [HTTP Request Smuggling, content length with invalid charters](https://agentprime.io/advisories/CVE-2021-32565.md)
  `CVE-2021-32565` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 29 Jun 2021 · Tags: HTTP request smuggling
- [Incorrect handling of url fragment leads to cache poisoning](https://agentprime.io/advisories/CVE-2021-27577.md)
  `CVE-2021-27577` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 29 Jun 2021 · Tags: HTTP request smuggling
- [Apache Software Foundation Apache Traffic Server: Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10…](https://agentprime.io/advisories/CVE-2020-9494.md)
  `CVE-2020-9494` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 24 Jun 2020
- [sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin.](https://agentprime.io/advisories/CVE-2018-11783.md)
  `CVE-2018-11783` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 7 Mar 2019
- [Apache Software Foundation Apache Traffic Server: Pages that are rendered using the ESI plugin can have access to the cookie header when…](https://agentprime.io/advisories/CVE-2018-8040.md)
  `CVE-2018-8040` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 29 Aug 2018
- [A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault.](https://agentprime.io/advisories/CVE-2018-8022.md)
  `CVE-2018-8022` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 29 Aug 2018
- [Apache Software Foundation Apache Traffic Server: When there are multiple ranges in a range request…](https://agentprime.io/advisories/CVE-2018-8005.md)
  `CVE-2018-8005` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 29 Aug 2018
- [Apache Software Foundation Apache Traffic Server: There are multiple HTTP smuggling and cache poisoning issues when clients making…](https://agentprime.io/advisories/CVE-2018-8004.md)
  `CVE-2018-8004` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 29 Aug 2018
- [Apache Software Foundation Apache Traffic Server: Adding method ACLs in remap.config can cause a segfault when the user makes a carefully…](https://agentprime.io/advisories/CVE-2018-1318.md)
  `CVE-2018-1318` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 29 Aug 2018
- [Apache Software Foundation Apache Traffic Server: There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2…](https://agentprime.io/advisories/CVE-2017-7671.md)
  `CVE-2017-7671` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 27 Feb 2018
- [Apache Software Foundation Apache Traffic Server: There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and…](https://agentprime.io/advisories/CVE-2017-5660.md)
  `CVE-2017-5660` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 27 Feb 2018
- [Apache Software Foundation Apache Traffic Server: Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between…](https://agentprime.io/advisories/CVE-2017-5659.md)
  `CVE-2017-5659` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 17 Apr 2017
- [Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.](https://agentprime.io/advisories/CVE-2016-5396.md)
  `CVE-2016-5396` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 17 Apr 2017

Newest: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-traffic-server.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=apache-software-foundation-apache-traffic-server&cursor=WyIyMDI1LTA0LTAzVDA4OjU5OjAyLjU1NzAwMFoiLCJDVkUtMjAyNC01Mzg2OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-traffic-server/?cursor=WyIyMDI1LTA0LTAzVDA4OjU5OjAyLjU1NzAwMFoiLCJDVkUtMjAyNC01Mzg2OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.