Where
AND
AND
-Infinity
0

Trending

Last week
Last month
Last year

Apache Traffic ServerApache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

Risk 30
Severity
6.3
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-65100

Apache Traffic ServerApache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service

Risk 43
Severity
6.3
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58187

Apache Traffic ServerApache Traffic Server: Out-of-bounds reads while parsing DNS responses

Risk 40
Severity
6.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Apache Traffic Server reads out of bounds while parsing DNS answers.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58160

Apache Traffic ServerApache Traffic Server: Improper server-session reuse can expose data across client connections

Risk 64
Severity
6.9
Infoleak
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58157

Apache Apache Traffic ServerApache Traffic Server: URL and port parsing errors allow access-control bypass

Risk 39
Severity
6.3
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58156

Apache Traffic ServerApache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification

Risk 39
Severity
6.3
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname.

This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-65325

Apache Traffic ServerApache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely

Risk 57
Severity
6.3
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58153

Apache Traffic ServerApache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory

Risk 33
Severity
6.9
Integer Overflow
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58152

Apache Traffic ServerApache Traffic Server: Request smuggling via chunked extension quoted-string parsing

Risk 44
Severity
6.9
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

First published (updated )
CVE-2026-24033

Apache Traffic ServerApache Traffic Server: Regex mappings match with malicious domain names

Risk 54
Severity
6.9
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Regular Expression without Anchors vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

First published (updated )
CVE-2026-22068

Apache Traffic ServerApache Traffic Server: Request smuggling via pipelining after a chunked message body

Risk 48
Severity
6.3
Input Validation
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Improper Input Validation vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3.

Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

First published (updated )
CVE-2024-38311

Apache Traffic ServerApache Traffic Server: Intercept plugins are not access controlled

Risk 48
Severity
6.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3.

Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

First published (updated )
CVE-2024-56195

Apache Traffic ServerApache Traffic Server: ACL is not fully compatible with older versions

Risk 48
Severity
6.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3.

Users are recommended to upgrade to version 10.0.4, which fixes the issue.

First published (updated )
CVE-2024-56196

Apache Traffic ServerApache Traffic Server: Expect header field can unreasonably retain resource

Risk 23
Severity
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Expected Behavior Violation vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3.

Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue.

First published (updated )
CVE-2024-56202

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203