Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

debian/trafficserverThere is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5…

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers. Upgrade to versions 7.1.9 and 8.0.6 or later versions.

First published (updated )
CVE-2020-1944

debian/trafficserverDynamic stack buffer overflow in cachekey plugin

Risk 86
Severity
9.8
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

First published (updated )
CVE-2021-35474

debian/trafficserverThere is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5…

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to versions 7.1.9 and 8.0.6 or later versions.

First published (updated )
CVE-2019-17559

debian/trafficserverThere is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5…

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to versions 7.1.9 and 8.0.6 or later versions.

First published (updated )
CVE-2019-17565

Apache Traffic Serverheap-buffer-overflow with stats-over-http plugin

Risk 86
Severity
9.8
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0.

First published (updated )
CVE-2021-43082

Apache Traffic ServerApache Traffic Server: Memory-safety errors in MIME and header parsing

Risk 80
Severity
9.2
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58154

Apache Apache Traffic ServerApache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

Risk 61
Severity
9.2
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58155

Apache Traffic ServerApache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

Risk 80
Severity
9.2
Null Pointer Dereference
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58161

Apache Traffic ServerApache Traffic Server: regex_remap plugin overflows the stack from attacker input

Risk 86
Severity
9.2
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The Apache Traffic Server regexremap plugin overflows the stack and integers from substitution input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58179

Apache Traffic ServerApache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies

Risk 66
Severity
9.1
Input Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.

First published (updated )
CVE-2023-33934

Apache Traffic ServerApache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

Risk 47
Severity
8.7
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58151

Apache Traffic ServerApache Traffic Server: Certifier plugin trusts client SNI when generating certificates

Risk 82
Severity
8.4
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58162

Apache Traffic ServerApache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

Risk 69
Severity
8.4
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58188

Apache Traffic ServerApache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

Risk 66
Severity
8.3
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58163

Apache Traffic ServerApache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free

Risk 60
Severity
8.3
Use After Free
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58164

Apache Traffic ServerApache Traffic Server: header_rewrite plugin cookie handling can corrupt memory

Risk 52
Severity
8.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

The Apache Traffic Server headerrewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58184

Apache Traffic ServerApache Traffic Server: Buffer overflow via Host field that has a long string value

Risk 43
Severity
8.2
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-33930

Apache Traffic ServerApache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-65324

Apache Traffic ServerApache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow

Risk 43
Severity
8.2
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58158

Apache Traffic ServerApache Traffic Server: HostDB SRV handling leaks memory

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server leaks memory when handling HostDB SRV records.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58175

Apache Traffic ServerApache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server urisigning and urlsig plugins can exhaust the stack or crash on attacker input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58181

Apache Traffic ServerApache Traffic Server: txn_box plugin overflows the stack from attacker input

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server txnbox plugin overflows the stack from attacker-controlled input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58180

Apache Traffic ServerApache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

Risk 43
Severity
8.2
Input Validation
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58186

Apache Traffic ServerApache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58178

Apache Traffic ServerApache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

Risk 43
Severity
8.2
SSRF
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58189

Apache Traffic ServerApache Traffic Server: Use-after-free in the intercept plugin

Risk 86
Severity
8.2
Use After Free
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server intercept plugin has a use-after-free.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58185

Apache Traffic ServerApache Traffic Server: prefetch plugin can crash on attacker-influenced input

Risk 43
Severity
8.2
Input Validation
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58183

Apache Traffic ServerApache Traffic Server: ts_lua plugin has initialization and resource-handling errors

Risk 64
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58182

debian/trafficserverImproper authentication vulnerability in TLS origin verification

Risk 75
Severity
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue affects Apache Traffic Server 8.0.0 to 8.1.0.

First published (updated )
CVE-2021-44759

debian/trafficserverNot validating origin TLS certificate

Risk 75
Severity
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traffic Server 8.0.0 to 8.0.8.

First published (updated )
CVE-2021-38161

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203