What’s Vulnerable › Products

Apache Software Foundation Apache Traffic Server vulnerabilities

137 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 68 published in the last 12 months.

Check whether your Apache Software Foundation Apache Traffic Server version is affected

Exploited Apache Software Foundation Apache Traffic Server vulnerabilities

• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability

Latest Apache Software Foundation Apache Traffic Server vulnerabilities

• CVE-2026-112381 — Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response (CVSS 5.9)
• CVE-2026-111817 — Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout (CVSS 5.3)
• CVE-2026-111815 — Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement (CVSS 10.0)
• CVE-2026-111814 — Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin (CVSS 10.0)
• CVE-2026-111812 — Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials (CVSS 10.0)
• CVE-2026-111811 — Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication (CVSS 9.0)
• CVE-2026-111810 — Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service (CVSS 7.5)
• CVE-2026-111809 — Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling (CVSS 9.3)
• CVE-2026-111808 — Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion (CVSS 8.6)
• CVE-2026-111805 — Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion (CVSS 8.6)
• CVE-2026-111816 — Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out (CVSS 9.3)
• CVE-2026-111813 — Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration (CVSS 10.0)
• CVE-2026-111804 — Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs (CVSS 8.2)
• CVE-2025-55702 — Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request (CVSS 8.7)
• CVE-2025-31699 — Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling (CVSS 8.9)
• CVE-2026-102795 — Apache Traffic Server: SNI to Host header matching policy is not properly enforced (CVSS 9.3)
• CVE-2026-65100 — Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode (CVSS 4.8)
• CVE-2026-58189 — Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification (CVSS 7.5)
• CVE-2026-58188 — Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins (CVSS 8.2)
• CVE-2026-58187 — Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service (CVSS 7.5)
• CVE-2026-58186 — Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses (CVSS 7.5)
• CVE-2026-58185 — Apache Traffic Server: Use-after-free in the intercept plugin (CVSS 9.8)
• CVE-2026-58184 — Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory (CVSS 7.5)
• CVE-2026-58183 — Apache Traffic Server: prefetch plugin can crash on attacker-influenced input (CVSS 7.5)
• CVE-2026-58182 — Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors (CVSS 8.6)