AT
Product
Apache Traffic Server
64
CVEs
0
On KEV
10.0
Max CVSS
16
New 30D
Severity mix
Critical 18High 35Medium 11Low 0
Watch
Add Apache Traffic Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111812 New | 10.0 | Oct 21 | Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.15; 10.0.0 through 10.1.4; 10.2.0 |
| CVE-2026-111815 New | 10.0 | Oct 21 | Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.15; 10.0.0 through 10.1.4; 10.2.0 |
| CVE-2026-111814 New | 10.0 | Oct 21 | Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin Affected: 9.0.0 through 9.2.15; 10.0.0 through 10.1.4; 10.2.0 |
| CVE-2026-111813 New | 10.0 | Oct 21 | Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration Affected: 8.0.1 through 8.1.11; 9.0.0 through 9.2.15; 10.0.0 through 10.1.4; 10.2.0 |
| CVE-2026-58162 | 10.0 | Jul 29 | Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-58150 | 10.0 | Jul 29 | Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-57834 | 10.0 | Jul 29 | Apache Traffic Server: Malformed chunked message body allows request smuggling Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-58185 | 9.8 | Jul 29 | Apache Traffic Server: Use-after-free in the intercept plugin Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-58179 | 9.8 | Jul 29 | Apache Traffic Server: regex_remap plugin overflows the stack from attacker input Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-58177 | 9.8 | Jul 29 | Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework Affected: 10.0.0 through 10.1.3 |
| CVE-2026-111809 New | 9.3 | Oct 21 | Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.15; 10.0.0 through 10.1.4; 10.2.0 |
| CVE-2026-111816 New | 9.3 | Oct 21 | Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.15; 10.0.0 through 10.1.4; 10.2.0 |
| CVE-2026-102795 | 9.3 | Oct 2 | Apache Traffic Server: SNI to Host header matching policy is not properly enforced Affected: 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-58155 | 9.3 | Jul 29 | Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-41920 | 9.3 | Jul 29 | Apache Traffic Server: SNI to Host header matching policy is not properly enforced Affected: 9.0.0 through 9.1.14; 10.0.0 through 10.1.3 |
| CVE-2026-58163 | 9.1 | Jul 29 | Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-33267 | 9.1 | Jul 29 | Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata Affected: 9.2.0 through 9.2.14; 10.1.0 through 10.1.3 |
| CVE-2026-111811 New | 9.0 | Oct 21 | Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.15; 10.0.0 through 10.1.4; 10.2.0 |
Showing 18