Apache Traffic Server: Memory-safety errors in MIME and header parsing

Apache Traffic Server: Improper server-session reuse can expose data across client connections

Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding

Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely

Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

Apache Traffic Server: Listener and ACL handling allow access-control bypass

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests

Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks

Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service

Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory

Apache Traffic Server: prefetch plugin can crash on attacker-influenced input

Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash

Apache Traffic Server: txn_box plugin overflows the stack from attacker input

Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

Apache Traffic Server: HostDB SRV handling leaks memory

Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free

Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions

Apache Traffic Server: Malformed chunked message body allows request smuggling

Apache Traffic Server: A simple legitimate POST request causes a crash

ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted

ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol

Apache Traffic Server allows request smuggling if chunked messages are malformed.  This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through…

Valid Host header field can cause Apache Traffic Server to crash on some platforms

Improper Input Validation vulnerability in Apache Traffic Server

Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers

Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0…

Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2

Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0…

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.  The configuration option proxy.config.http.push_method_enabled didn't function. …

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to…

Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions

Improper HTTP/2 scheme and method validation

Improper input validation on HTTP/2 headers

Insufficient Validation of HTTP/1.x Headers

HTTP/2 framing vulnerabilities

Transfer-Encoding not treated as hop-by-hop

Protocol vs scheme mismatch

Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests

Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests