TS
Product
Traffic Server
120
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 21High 75Medium 20Low 0
Watch
Add Traffic Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-37148 | 7.5 | Nov 3 | Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests Affected: 8.0.0 through 8.1.2; 9.0.0 through 9.0.1 |
| CVE-2021-37147 | 7.5 | Nov 3 | Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests Affected: 8.0.0 through 8.1.2; 9.0.0 through 9.1.0 |
| CVE-2021-32567 | 7.5 | Jun 30 | Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server Affected: 7.0.0 through 7.1.12; 8.0.0 through 8.1.1; 9.0.0 through 9.0.1 |
| CVE-2021-32566 | 7.5 | Jun 30 | Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server Affected: 7.0.0 through 7.1.12; 8.0.0 through 8.1.1; 9.0.0 through 9.0.1 |
| CVE-2021-32565 | 7.5 | Jun 29 | Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests Affected: 7.0.0 through 7.1.12; 8.0.0 through 8.1.1; 9.0.0 through 9.0.1 |
| CVE-2021-27577 | 7.5 | Jun 29 | Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache Affected: 7.0.0 through 7.1.12; 8.0.0 through 8.1.1; 9.0.0 through 9.0.1 |
| CVE-2021-27737 | 7.5 | May 14 | Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin Affected: 9.0.0 |
| CVE-2020-17509 | 7.5 | Jan 11 | ATS negative cache option is vulnerable to a cache poisoning attack Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.10; 8.0.0 through 8.0.7 |
| CVE-2020-17508 | 7.5 | Jan 11 | The ATS ESI plugin has a memory disclosure vulnerability Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.11; 8.0.0 through 8.1.0 |
| CVE-2020-9494 | 7.5 | Jun 24 | Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large… Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.10; 8.0.0 through 8.0.7 |
| CVE-2020-9481 | 7.5 | Apr 27 | Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.9; 8.0.0 through 8.0.6 |
| CVE-2019-10079 | 7.5 | Oct 22 | Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks Affected: before 7.1.7; 8.0.0 before 8.0.4 |
| CVE-2019-9518 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.6; 8.0.0 through 8.0.3 |
| CVE-2019-9517 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.6; 8.0.0 through 8.0.3 |
| CVE-2019-9515 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.6; 8.0.0 through 8.0.3 |
| CVE-2019-9514 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.6; 8.0.0 through 8.0.3 |
| CVE-2019-9513 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.6; 8.0.0 through 8.0.3 |
| CVE-2019-9512 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.6; 8.0.0 through 8.0.3 |
| CVE-2019-9511 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.6; 8.0.0 through 8.0.3 |
| CVE-2018-11783 | 7.5 | Mar 7 | sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin Affected: 6.0.0 through 6.0.3; 7.0.0 through 7.1.5; 8.0.0 through 8.0.1 |
| CVE-2018-8022 | 7.5 | Aug 29 | A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault Affected: 6.0.0 through 6.2.2 |
| CVE-2018-1318 | 7.5 | Aug 29 | Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request Affected: 6.0.0 through 6.2.2; 7.0.0 through 7.1.3 |
| CVE-2017-7671 | 7.5 | Feb 27 | There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake Affected: 5.2.0 through 5.3.2; after 6.0.0 through 6.2.0; 7.0.0 |
| CVE-2017-5659 | 7.5 | Apr 17 | Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding Affected: through 6.2.0 |
| CVE-2016-5396 | 7.5 | Apr 17 | Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack Affected: 6.0.0; 6.1.0; 6.1.1; 6.2.0 |