Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling

Apache Traffic Server: Memory-safety errors in MIME and header parsing

Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request

Apache Traffic Server: Improper server-session reuse can expose data across client connections

Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion

Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion

Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely

Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs

Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

Apache Traffic Server: Listener and ACL handling allow access-control bypass

Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service

Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service

Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory

Apache Traffic Server: prefetch plugin can crash on attacker-influenced input

Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash

Apache Traffic Server: txn_box plugin overflows the stack from attacker input

Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

Apache Traffic Server: HostDB SRV handling leaks memory

Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free

Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions

Apache Traffic Server: Malformed chunked message body allows request smuggling

Apache Traffic Server: A simple legitimate POST request causes a crash

Improper HTTP/2 scheme and method validation

Improper input validation on HTTP/2 headers

HTTP/2 framing vulnerabilities

Protocol vs scheme mismatch

Transfer-Encoding not treated as hop-by-hop

Insufficient Validation of HTTP/1.x Headers

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin