Apache Software Foundation Apache Traffic Server
95 CVEs affecting Apache Software Foundation Apache Traffic Server. Latest disclosed: 2026-07-29. Critical: 10, High: 66.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-58162 | Critical | 10.0 | 2026-07-29 | The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0… |
CVE-2026-58150 | Critical | 10.0 | 2026-07-29 | Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: fr… |
CVE-2026-57834 | Critical | 10.0 | 2026-07-29 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0… |
CVE-2026-33267 | Critical | 10.0 | 2026-07-29 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10… |
CVE-2021-43082 | Critical | 9.8 | 2021-11-03 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker… |
CVE-2021-35474 | Critical | 9.8 | 2021-06-30 | Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1… |
CVE-2026-58155 | Critical | 9.3 | 2026-07-29 | Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Serv… |
CVE-2026-41920 | Critical | 9.3 | 2026-07-29 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1… |
CVE-2024-50306 | Critical | 9.1 | 2024-11-14 | Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, fr… |
CVE-2023-33934 | Critical | 9.1 | 2023-08-09 | Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1. |
CVE-2026-58154 | High | 8.9 | 2026-07-29 | Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 t… |
CVE-2026-58157 | High | 8.7 | 2026-07-29 | Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: fro… |
CVE-2026-58182 | High | 8.6 | 2026-07-29 | The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8… |
CVE-2017-5660 | High | 8.6 | 2018-02-27 | There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when in… |
CVE-2026-58153 | High | 8.3 | 2026-07-29 | Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Ap… |
CVE-2026-58188 | High | 8.2 | 2026-07-29 | Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
CVE-2026-58184 | High | 8.2 | 2026-07-29 | The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Tr… |
CVE-2026-58159 | High | 8.2 | 2026-07-29 | Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 thr… |
CVE-2026-22068 | High | 8.2 | 2026-07-29 | Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X th… |
CVE-2024-35296 | High | 8.2 | 2024-07-26 | Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: f… |