TS
Product
Traffic Server
120
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 21High 75Medium 20Low 0
Watch
Add Traffic Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58162 | 10.0 | Jul 29 | Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-58150 | 10.0 | Jul 29 | Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-57834 | 10.0 | Jul 29 | Apache Traffic Server: Malformed chunked message body allows request smuggling Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-58185 | 9.8 | Jul 29 | Apache Traffic Server: Use-after-free in the intercept plugin Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-58179 | 9.8 | Jul 29 | Apache Traffic Server: regex_remap plugin overflows the stack from attacker input Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-58177 | 9.8 | Jul 29 | Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework Affected: 10.0.0 before 10.1.4 |
| CVE-2021-43082 | 9.8 | Nov 3 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory Affected: 8.0.0 through 8.1.2; 9.0.0 through 9.1.0 |
| CVE-2021-35474 | 9.8 | Jun 30 | Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server Affected: 7.0.0 through 7.1.12; 8.0.0 through 8.1.1; 9.0.0 through 9.0.1 |
| CVE-2020-1944 | 9.8 | Mar 23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.8; 8.0.0 through 8.0.5 |
| CVE-2019-17565 | 9.8 | Mar 23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.8; 8.0.0 through 8.0.5 |
| CVE-2019-17559 | 9.8 | Mar 23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing Affected: 6.0.0 through 6.2.3; 7.0.0 through 7.1.8; 8.0.0 through 8.0.5 |
| CVE-2015-3249 | 9.8 | Oct 30 | The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or… Affected: 5.3.0 |
| CVE-2014-3624 | 9.8 | Oct 30 | Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT Affected: 5.1.0 |
| CVE-2015-5206 | 9.8 | Sep 13 | Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability… Affected: 5.3.0; 5.3.1 |
| CVE-2015-5168 | 9.8 | Sep 13 | Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than… Affected: 5.3.0; 5.3.1 |
| CVE-2026-58155 | 9.3 | Jul 29 | Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-41920 | 9.3 | Jul 29 | Apache Traffic Server: SNI to Host header matching policy is not properly enforced Affected: 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-58163 | 9.1 | Jul 29 | Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server Affected: 8.0.0 through 8.1.9; 9.0.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2026-33267 | 9.1 | Jul 29 | Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata Affected: 9.2.0 before 9.2.15; 10.0.0 before 10.1.4 |
| CVE-2024-50306 | 9.1 | Nov 14 | Unchecked return value can allow Apache Traffic Server to retain privileges on startup Affected: 9.0.0 before 9.2.6; 10.0.0 before 10.0.2 |
| CVE-2023-33934 | 9.1 | Aug 9 | Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1 Affected: 8.0.0 through 8.1.7; 9.0.0 through 9.2.1 |
Showing 21