Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates

Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling

Apache Traffic Server: Malformed chunked message body allows request smuggling

Apache Traffic Server: Use-after-free in the intercept plugin

Apache Traffic Server: regex_remap plugin overflows the stack from attacker input

Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory

Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or…

Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT

Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability…

Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than…

Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata

Unchecked return value can allow Apache Traffic Server to retain privileges on startup

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1

Apache Traffic Server: Memory-safety errors in MIME and header parsing

Apache Traffic Server: Improper server-session reuse can expose data across client connections

Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding

Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely

Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

Apache Traffic Server: Listener and ACL handling allow access-control bypass

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests

Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks

Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service

Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory

Apache Traffic Server: prefetch plugin can crash on attacker-influenced input

Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash

Apache Traffic Server: txn_box plugin overflows the stack from attacker input

Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

Apache Traffic Server: HostDB SRV handling leaks memory

Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free

Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions

Apache Traffic Server: Malformed chunked message body allows request smuggling

Apache Traffic Server: A simple legitimate POST request causes a crash

ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted

ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol

Apache Traffic Server allows request smuggling if chunked messages are malformed.  This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through…