AT
Product
Apache Traffic Server
64
CVEs
0
On KEV
10.0
Max CVSS
16
New 30D
Severity mix
Critical 18High 35Medium 11Low 0
Watch
Add Apache Traffic Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58160 | 6.5 | Jul 29 | Apache Traffic Server: Out-of-bounds reads while parsing DNS responses Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-112381 | 5.9 | Oct 21 | Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response Affected: 9.2.15; 10.1.4; 10.2.0 |
| CVE-2026-58158 | 5.9 | Jul 29 | Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-58152 | 5.9 | Jul 29 | Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-33930 | 5.9 | Jul 29 | Apache Traffic Server: Buffer overflow via Host field that has a long string value Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-111817 | 5.3 | Oct 21 | Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout Affected: 8.1.11; 9.2.5 through 9.2.15; 10.0.0 through 10.1.4; 10.2.0 |
| CVE-2026-24033 | 5.3 | Jul 29 | Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing Affected: 10.0.0 through 10.1.3; 9.0.0 through 9.2.14 |
| CVE-2026-22068 | 5.3 | Jul 29 | Apache Traffic Server: Regex mappings match with malicious domain names Affected: 10.0.x through 10.1.3; 9.0.x through 9.2.14 |
| CVE-2026-58156 | 4.9 | Jul 29 | Apache Traffic Server: URL and port parsing errors allow access-control bypass Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-65100 | 4.8 | Jul 29 | Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode Affected: 8.0.0 through 8.1.11; 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
| CVE-2026-65325 | 4.8 | Jul 29 | Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification Affected: 9.0.0 through 9.2.14; 10.0.0 through 10.1.3 |
Showing 11
