CveMateVulnerability intelligence

Apache Software Foundation Apache Traffic Server vulnerabilities, page 2

96 vulnerabilities

Known vulnerabilities in Apache Software Foundation Apache Traffic Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

CVE-2016-5396apache software foundationapache traffic server+29y ago17-04-2017 18:00

Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.CVE-2025-65114apache software foundationapache traffic server+36mo ago02-04-2026 15:55

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1. Users are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue.CVE-2025-31698apache software foundationapache traffic server+31y ago19-06-2025 10:07

ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol. This issue affects undefined: from 10.0.0 through 10.0.6, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.CVE-2025-58136apache software foundationapache traffic server+36mo ago02-04-2026 15:54

A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).CVE-2025-49763apache software foundationapache traffic server+31y ago19-06-2025 10:07

ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.CVE-2020-9494apache software foundationapache traffic server+46y ago24-06-2020 15:25

Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.CVE-2022-40743apache software foundationapache traffic server+33y ago19-12-2022 11:06

Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.1.4 or later versions.CVE-2022-47184apache software foundationapache traffic server+43y ago14-06-2023 07:42

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.CVE-2022-47185apache software foundationapache traffic server+33y ago09-08-2023 06:57

Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.CVE-2022-31780apache software foundationapache traffic server+54y ago10-08-2022 00:00

Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.CVE-2022-31778apache software foundationapache traffic server+44y ago10-08-2022 00:00

Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.CVE-2022-31779apache software foundationapache traffic server+54y ago10-08-2022 05:50

Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.CVE-2022-25763apache software foundationapache traffic server+54y ago10-08-2022 05:50

Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.CVE-2022-37392apache software foundationapache traffic server+33y ago19-12-2022 10:59

Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.CVE-2022-28129apache software foundationapache traffic server+54y ago10-08-2022 00:00

Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.CVE-2022-32749apache software foundationapache traffic server+33y ago19-12-2022 10:51

Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions. This issue affects Apache Traffic Server: from 8.0.0 through 9.1.3.CVE-2017-7671apache software foundationapache traffic server+48y ago27-02-2018 20:00

There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump.CVE-2017-5659apache software foundationapache traffic server+39y ago17-04-2017 18:00

Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.CVE-2017-5660apache software foundationapache traffic server+48y ago27-02-2018 20:00

There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.CVE-2024-31309apache software foundationapache traffic server+52y ago10-04-2024 12:07

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.