Valid Host header field can cause Apache Traffic Server to crash on some platforms

Improper Input Validation vulnerability in Apache Traffic Server

Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers

Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0…

Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2

Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0…

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.  The configuration option proxy.config.http.push_method_enabled didn't function. …

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to…

Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions

Improper HTTP/2 scheme and method validation

Improper input validation on HTTP/2 headers

Insufficient Validation of HTTP/1.x Headers

HTTP/2 framing vulnerabilities

Transfer-Encoding not treated as hop-by-hop

Protocol vs scheme mismatch

Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests

Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests

Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server

Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server

Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests

Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache

Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin

ATS negative cache option is vulnerable to a cache poisoning attack

The ATS ESI plugin has a memory disclosure vulnerability

Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large…

Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack

Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin

A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault

Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request

There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake

Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding

Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack

Apache Traffic Server: Out-of-bounds reads while parsing DNS responses

In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS)