Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

Apache Traffic ServerApache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions

Risk 46
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Uncontrolled Resource Consumption vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2.

Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue.

First published (updated )
CVE-2026-59173

Apache Traffic ServerApache Traffic Server: Request smuggling via chunked extension quoted-string parsing

Risk 44
Severity
6.9
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

First published (updated )
CVE-2026-24033

Apache Traffic ServerApache Traffic Server: Regex mappings match with malicious domain names

Risk 54
Severity
6.9
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Regular Expression without Anchors vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

First published (updated )
CVE-2026-22068

Apache Traffic ServerApache Traffic Server: Untrusted @ headers can spoof ATS internal metadata

Risk 73
Severity
7.7
Input Validation
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Improper Input Validation vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

First published (updated )
CVE-2026-33267

Apache Traffic ServerApache Traffic Server: Improper server-session reuse can expose data across client connections

Risk 64
Severity
6.9
Infoleak
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58157

Apache Traffic ServerApache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow

Risk 43
Severity
8.2
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58158

Apache Traffic ServerApache Traffic Server: Listener and ACL handling allow access-control bypass

Risk 54
Severity
7
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58159

Apache Traffic ServerApache Traffic Server: Out-of-bounds reads while parsing DNS responses

Risk 40
Severity
6.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Apache Traffic Server reads out of bounds while parsing DNS answers.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58160

Apache Traffic ServerApache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

Risk 80
Severity
9.2
Null Pointer Dereference
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58161

Apache Traffic ServerApache Traffic Server: Certifier plugin trusts client SNI when generating certificates

Risk 82
Severity
8.4
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58162

Apache Traffic ServerApache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

Risk 66
Severity
8.3
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58163

Apache Traffic ServerApache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free

Risk 60
Severity
8.3
Use After Free
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58164

Apache Traffic ServerApache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

Risk 30
Severity
6.3
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-65100

Apache Traffic ServerApache Traffic Server: Buffer overflow via Host field that has a long string value

Risk 43
Severity
8.2
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-33930

Apache Traffic ServerApache Traffic Server: SNI to Host header matching policy is not properly enforced

Risk 61
Severity
7
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

First published (updated )
CVE-2026-41920

Apache Apache Traffic ServerApache Traffic Server: Malformed chunked message body allows request smuggling

Risk 82
Severity
7
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Apache Traffic Server allows request smuggling if chunked messages are malformed.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-57834

Apache Traffic ServerApache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling

Risk 73
Severity
7.8
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58150

Apache Traffic ServerApache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

Risk 47
Severity
8.7
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58151

Apache Traffic ServerApache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory

Risk 33
Severity
6.9
Integer Overflow
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58152

Apache Traffic ServerApache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely

Risk 57
Severity
6.3
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58153

Apache Traffic ServerApache Traffic Server: Memory-safety errors in MIME and header parsing

Risk 80
Severity
9.2
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58154

Apache Apache Traffic ServerApache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

Risk 61
Severity
9.2
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58155

Apache Apache Traffic ServerApache Traffic Server: URL and port parsing errors allow access-control bypass

Risk 39
Severity
6.3
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58156

Apache Traffic ServerApache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-65324

Apache Traffic ServerApache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification

Risk 39
Severity
6.3
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname.

This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-65325

Apache Traffic ServerApache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

Risk 69
Severity
8.4
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58188

Apache Traffic ServerApache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

Risk 43
Severity
8.2
SSRF
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58189

Apache Traffic ServerApache Traffic Server: HostDB SRV handling leaks memory

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server leaks memory when handling HostDB SRV records.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58175

Apache Traffic ServerApache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework

Risk 86
Severity
8.3
Use After Free, Path Traversal
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58177

Apache Traffic ServerApache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58178

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203