Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

Apache Traffic ServerApache Traffic Server: Memory-safety errors in MIME and header parsing

Risk 80
Severity
9.2
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58154

Apache Apache Traffic ServerApache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

Risk 61
Severity
9.2
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58155

Apache Traffic ServerApache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

Risk 80
Severity
9.2
Null Pointer Dereference
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58161

Apache Traffic ServerApache Traffic Server: regex_remap plugin overflows the stack from attacker input

Risk 86
Severity
9.2
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The Apache Traffic Server regexremap plugin overflows the stack and integers from substitution input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58179

Apache Traffic ServerApache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

Risk 47
Severity
8.7
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58151

Apache Traffic ServerApache Traffic Server: Certifier plugin trusts client SNI when generating certificates

Risk 82
Severity
8.4
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58162

Apache Traffic ServerApache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

Risk 69
Severity
8.4
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58188

Apache Traffic ServerApache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

Risk 66
Severity
8.3
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58163

Apache Traffic ServerApache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free

Risk 60
Severity
8.3
Use After Free
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58164

Apache Traffic ServerApache Traffic Server: header_rewrite plugin cookie handling can corrupt memory

Risk 52
Severity
8.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

The Apache Traffic Server headerrewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58184

Apache Traffic ServerApache Traffic Server: Buffer overflow via Host field that has a long string value

Risk 43
Severity
8.2
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-33930

Apache Traffic ServerApache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-65324

Apache Traffic ServerApache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow

Risk 43
Severity
8.2
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58158

Apache Traffic ServerApache Traffic Server: HostDB SRV handling leaks memory

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server leaks memory when handling HostDB SRV records.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58175

Apache Traffic ServerApache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server urisigning and urlsig plugins can exhaust the stack or crash on attacker input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58181

Apache Traffic ServerApache Traffic Server: txn_box plugin overflows the stack from attacker input

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server txnbox plugin overflows the stack from attacker-controlled input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58180

Apache Traffic ServerApache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

Risk 43
Severity
8.2
Input Validation
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server webptransform plugin can decode unsafely and serve mislabeled, cacheable responses.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58186

Apache Traffic ServerApache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

Risk 43
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58178

Apache Traffic ServerApache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

Risk 43
Severity
8.2
SSRF
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58189

Apache Traffic ServerApache Traffic Server: Use-after-free in the intercept plugin

Risk 86
Severity
8.2
Use After Free
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server intercept plugin has a use-after-free.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58185

Apache Traffic ServerApache Traffic Server: prefetch plugin can crash on attacker-influenced input

Risk 43
Severity
8.2
Input Validation
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58183

Apache Traffic ServerApache Traffic Server: ts_lua plugin has initialization and resource-handling errors

Risk 64
Severity
8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

The Apache Traffic Server tslua plugin mishandles initialization, transform context, and per-instance state.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58182

Apache Traffic ServerApache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling

Risk 73
Severity
7.8
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58150

Apache Apache Traffic ServerApache Traffic Server: Malformed chunked message body allows request smuggling

Risk 82
Severity
7
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Apache Traffic Server allows request smuggling if chunked messages are malformed.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-57834

Apache Traffic ServerApache Traffic Server: Listener and ACL handling allow access-control bypass

Risk 54
Severity
7
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58159

Apache Traffic ServerApache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory

Risk 33
Severity
6.9
Integer Overflow
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58152

Apache Traffic ServerApache Traffic Server: Improper server-session reuse can expose data across client connections

Risk 64
Severity
6.9
Infoleak
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58157

Apache Apache Traffic ServerApache Traffic Server: URL and port parsing errors allow access-control bypass

Risk 39
Severity
6.3
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58156

Apache Traffic ServerApache Traffic Server: Out-of-bounds reads while parsing DNS responses

Risk 40
Severity
6.3
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Apache Traffic Server reads out of bounds while parsing DNS answers.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58160

Apache Traffic ServerApache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service

Risk 43
Severity
6.3
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

First published (updated )
CVE-2026-58187

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203