Advisories · Technology

Apache Software Foundation Apache Traffic Server.

Every CVE that names Apache Software Foundation Apache Traffic Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-38311 CVE record

CVSS 6.3 Medium

Apache Traffic Server: Request smuggling via pipelining after a chunked message body
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 6 Mar 2025
CVE-2024-56195 CVE record

CVSS 6.3 Medium

Apache Traffic Server: Intercept plugins are not access controlled
- Apache Software Foundation Apache Traffic Server
- Broken access control
Not analysed yet 6 Mar 2025
CVE-2024-56196 CVE record

CVSS 6.3 Medium

Apache Traffic Server: ACL is not fully compatible with older versions
- Apache Software Foundation Apache Traffic Server
- Broken access control
Not analysed yet 6 Mar 2025
CVE-2024-56202 CVE record

CVSS 4.3 Medium

Apache Traffic Server: Expect header field can unreasonably retain resource
- Apache Software Foundation Apache Traffic Server
- CWE-440
Not analysed yet 6 Mar 2025
CVE-2024-50306 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Traffic Server: Server process can fail to drop privilege
- Apache Software Foundation Apache Traffic Server
- CWE-252
Not analysed yet 14 Nov 2024
CVE-2024-50305 CVE record

CVSS 7.5 High

Apache Traffic Server: Valid Host field value can cause crashes
- Apache Software Foundation Apache Traffic Server
- Memory corruption
- CWE-20
Not analysed yet 14 Nov 2024
CVE-2024-38479 CVE record

CVSS 7.5 High

Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 14 Nov 2024
CVE-2023-38522 CVE record

CVSS 7.5 High

Apache Traffic Server: Incomplete field name check allows request smuggling
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
Not analysed yet 26 Jul 2024
CVE-2024-35296 CVE record

CVSS 8.2 High

Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 26 Jul 2024
CVE-2024-35161 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
Not analysed yet 26 Jul 2024
CVE-2024-31309 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 10 Apr 2024
CVE-2023-39456 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Apache Traffic Server: Malformed http/2 frames can cause an abort
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 17 Oct 2023
CVE-2023-41752 CVE record

CVSS 7.5 High

Apache Traffic Server: s3_auth plugin problem with hash calculation
- Apache Software Foundation Apache Traffic Server
- Information disclosure
Not analysed yet 17 Oct 2023
CVE-2023-33934 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
Not analysed yet 9 Aug 2023
CVE-2022-47185 CVE record

CVSS 7.5 High

Apache Traffic Server: Invalid Range header causes a crash
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 9 Aug 2023
CVE-2023-30631 CVE record

Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 14 Jun 2023
CVE-2023-33933 CVE record

CVSS 7.5 High

Apache Traffic Server: s3_auth plugin problem with hash calculation
- Apache Software Foundation Apache Traffic Server
- Information disclosure
Not analysed yet 14 Jun 2023
CVE-2022-47184 CVE record

CVSS 7.5 High

Apache Traffic Server: The TRACE method can be use to disclose network information
- Apache Software Foundation Apache Traffic Server
- Information disclosure
Not analysed yet 14 Jun 2023
CVE-2022-40743 CVE record

CVSS 6.1 Medium

Apache Traffic Server: Security issues with the xdebug plugin
- Apache Software Foundation Apache Traffic Server
- Cross-site scripting (XSS)
Not analysed yet 19 Dec 2022
CVE-2022-37392 CVE record

CVSS 5.3 Medium

Apache Traffic Server: Improperly reading the client requests
- Apache Software Foundation Apache Traffic Server
- CWE-754
Not analysed yet 19 Dec 2022
CVE-2022-32749 CVE record

CVSS 7.5 High

Apache Traffic Server: Improperly handled requests can cause crashes in specific plugins
- Apache Software Foundation Apache Traffic Server
- CWE-754
Not analysed yet 19 Dec 2022
CVE-2022-31779 CVE record

Improper HTTP/2 scheme and method validation
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 10 Aug 2022
CVE-2022-25763 CVE record

CVSS 6.8 Medium

Improper input validation on HTTP/2 headers
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
Not analysed yet 10 Aug 2022
CVE-2022-31780 CVE record

HTTP/2 framing vulnerabilities
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 10 Aug 2022
CVE-2022-31778 CVE record

Transfer-Encoding not treated as hop-by-hop
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 10 Aug 2022
CVE-2022-28129 CVE record

Insufficient Validation of HTTP/1.x Headers
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 10 Aug 2022
CVE-2021-37150 CVE record

CVSS 4.2 Medium

Protocol vs scheme mismatch
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 10 Aug 2022
CVE-2021-44759 CVE record

Improper authentication vulnerability in TLS origin verification
- Apache Software Foundation Apache Traffic Server
- Authentication bypass
Not analysed yet 23 Mar 2022
CVE-2021-44040 CVE record

HTTP request line fuzzing attacks
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 23 Mar 2022
CVE-2021-43082 CVE record

heap-buffer-overflow with stats-over-http plugin
- Apache Software Foundation Apache Traffic Server
- Memory corruption
Not analysed yet 3 Nov 2021
CVE-2021-41585 CVE record

ATS stops accepting connections on FreeBSD
- Apache Software Foundation Apache Traffic Server
Not analysed yet 3 Nov 2021
CVE-2021-38161 CVE record

Not validating origin TLS certificate
- Apache Software Foundation Apache Traffic Server
- Authentication bypass
Not analysed yet 3 Nov 2021
CVE-2021-37149 CVE record

Request Smuggling - multiple attacks
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 3 Nov 2021
CVE-2021-37148 CVE record

Request Smuggling - transfer encoding validation
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 3 Nov 2021
CVE-2021-37147 CVE record

Request Smuggling - LF line ending
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
- CWE-20
Not analysed yet 3 Nov 2021
CVE-2021-35474 CVE record

Dynamic stack buffer overflow in cachekey plugin
- Apache Software Foundation Apache Traffic Server
- Memory corruption
Not analysed yet 30 Jun 2021
CVE-2021-32567 CVE record

Reading HTTP/2 frames too many times
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 30 Jun 2021
CVE-2021-32566 CVE record

Specific sequence of HTTP/2 frames can cause ATS to crash
- Apache Software Foundation Apache Traffic Server
- CWE-20
Not analysed yet 30 Jun 2021
CVE-2021-32565 CVE record

HTTP Request Smuggling, content length with invalid charters
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
Not analysed yet 29 Jun 2021
CVE-2021-27577 CVE record

Incorrect handling of url fragment leads to cache poisoning
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
Not analysed yet 29 Jun 2021
CVE-2020-9494 CVE record

Apache Software Foundation Apache Traffic Server: Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10…
- Apache Software Foundation Apache Traffic Server
Not analysed yet 24 Jun 2020
CVE-2018-11783 CVE record

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin.
- Apache Software Foundation Apache Traffic Server
Not analysed yet 7 Mar 2019
CVE-2018-8040 CVE record

Apache Software Foundation Apache Traffic Server: Pages that are rendered using the ESI plugin can have access to the cookie header when…
- Apache Software Foundation Apache Traffic Server
Not analysed yet 29 Aug 2018
CVE-2018-8022 CVE record

A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault.
- Apache Software Foundation Apache Traffic Server
Not analysed yet 29 Aug 2018
CVE-2018-8005 CVE record

Apache Software Foundation Apache Traffic Server: When there are multiple ranges in a range request…
- Apache Software Foundation Apache Traffic Server
Not analysed yet 29 Aug 2018
CVE-2018-8004 CVE record

Apache Software Foundation Apache Traffic Server: There are multiple HTTP smuggling and cache poisoning issues when clients making…
- Apache Software Foundation Apache Traffic Server
Not analysed yet 29 Aug 2018
CVE-2018-1318 CVE record

Apache Software Foundation Apache Traffic Server: Adding method ACLs in remap.config can cause a segfault when the user makes a carefully…
- Apache Software Foundation Apache Traffic Server
Not analysed yet 29 Aug 2018
CVE-2017-7671 CVE record

Apache Software Foundation Apache Traffic Server: There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2…
- Apache Software Foundation Apache Traffic Server
Not analysed yet 27 Feb 2018
CVE-2017-5660 CVE record

Apache Software Foundation Apache Traffic Server: There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and…
- Apache Software Foundation Apache Traffic Server
Not analysed yet 27 Feb 2018
CVE-2017-5659 CVE record

Apache Software Foundation Apache Traffic Server: Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between…
- Apache Software Foundation Apache Traffic Server
Not analysed yet 17 Apr 2017
CVE-2016-5396 CVE record

Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.
- Apache Software Foundation Apache Traffic Server
Not analysed yet 17 Apr 2017