TS
Product
Traffic Server
120
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 21High 75Medium 20Low 0
Watch
Add Traffic Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-56196 | 6.3 | Mar 6 | Improper Access Control vulnerability in Apache Traffic Server Affected: 10.0.0 before 10.0.4 |
| CVE-2024-56195 | 6.3 | Mar 6 | Improper Access Control vulnerability in Apache Traffic Server Affected: 9.0.0 before 9.2.9; 10.0.0 before 10.0.4 |
| CVE-2024-38311 | 6.3 | Mar 6 | Improper Input Validation vulnerability in Apache Traffic Server Affected: 9.0.0 before 9.2.9; 10.0.0 before 10.0.4 |
| CVE-2022-40743 | 6.1 | Dec 19 | Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This… Affected: 8.0.0 through 8.1.5; 9.0.0 through 9.1.3 |
| CVE-2026-58158 | 5.9 | Jul 29 | Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-58152 | 5.9 | Jul 29 | Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-33930 | 5.9 | Jul 29 | Apache Traffic Server: Buffer overflow via Host field that has a long string value Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-24033 | 5.3 | Jul 29 | Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing Affected: 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-22068 | 5.3 | Jul 29 | Apache Traffic Server: Regex mappings match with malicious domain names Affected: 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2022-37392 | 5.3 | Dec 19 | Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server Affected: 8.0.0 before 8.1.6; 9.0.0 before 9.1.4 |
| CVE-2018-8040 | 5.3 | Aug 29 | Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access Affected: 6.0.0 through 6.2.2; 7.0.0 through 7.1.3 |
| CVE-2018-8005 | 5.3 | Aug 29 | When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache Affected: 6.0.0 through 6.2.2; 7.0.0 through 7.1.3 |
| CVE-2026-58156 | 4.9 | Jul 29 | Apache Traffic Server: URL and port parsing errors allow access-control bypass Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-65100 | 4.8 | Jul 29 | Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-65325 | 4.8 | Jul 29 | Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification Affected: 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2024-56202 | 4.3 | Mar 6 | Expected Behavior Violation vulnerability in Apache Traffic Server Affected: 9.0.0 before 9.2.9; 10.0.0 before 10.0.4 |
| CVE-2014-10022 | – | Jan 13 | Apache Traffic Server before 5.1.2 allows remote attackers to cause a denial of service via unspecified vectors, related to internal buffer sizing Affected: through 5.1.1 |
| CVE-2014-3525 | – | Aug 22 | Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health… Affected: 2.0.0; 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; +29 more |
| CVE-2012-0256 | – | Mar 26 | Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service… Affected: 2.0.0; 2.0.0; 2.0.1; 2.1.0; 2.1.1; 2.1.2; +14 more |
| CVE-2010-2952 | – | Sep 13 | Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to… Affected: through 2.0.0; 2.1.0; 2.1.1 |