Apache Traffic_server
82 CVEs affecting Apache Traffic_server. Latest disclosed: 2026-04-02. Critical: 11, High: 56.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-43082 | Critical | 9.8 | 2021-11-03 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker… |
CVE-2021-35474 | Critical | 9.8 | 2021-06-30 | Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1… |
CVE-2020-1944 | Critical | 9.8 | 2020-03-23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content… |
CVE-2019-17565 | Critical | 9.8 | 2020-03-23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to v… |
CVE-2019-17559 | Critical | 9.8 | 2020-03-23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to ver… |
CVE-2015-3249 | Critical | 9.8 | 2017-10-30 | The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daem… |
CVE-2014-3624 | Critical | 9.8 | 2017-10-30 | Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CO… |
CVE-2015-5206 | Critical | 9.8 | 2017-09-13 | Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a differ… |
CVE-2015-5168 | Critical | 9.8 | 2017-09-13 | Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vul… |
CVE-2024-50306 | Critical | 9.1 | 2024-11-14 | Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, fr… |
CVE-2023-33934 | Critical | 9.1 | 2023-08-09 | Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1. |
CVE-2017-5660 | High | 8.6 | 2018-02-27 | There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when in… |
CVE-2024-35296 | High | 8.2 | 2024-07-26 | Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: f… |
CVE-2021-44759 | High | 8.1 | 2022-03-23 | Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue aff… |
CVE-2021-38161 | High | 8.1 | 2021-11-03 | Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traff… |
CVE-2025-65114 | High | 7.5 | 2026-04-02 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 1… |
CVE-2025-58136 | High | 7.5 | 2026-04-02 | A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 thro… |
CVE-2025-49763 | High | 7.5 | 2025-06-19 | ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can… |
CVE-2025-31698 | High | 7.5 | 2025-06-19 | ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl… |
CVE-2024-53868 | High | 7.5 | 2025-04-03 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, fro… |