Apache Traffic Server vulnerabilities

82 known vulnerabilities affecting apache/traffic_server.

Total CVEs

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL12HIGH56MEDIUM14

Vulnerabilities

SortPage 3 of 5

CVE-2024-38479P3HIGHCVSS 7.5≥ 8.0.0, ≤ 8.1.11≥ 9.0.0, < 9.2.62024-11-14

CVE-2024-38479 [HIGH] CWE-20 CVE-2024-38479: Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

nvd

CVE-2021-37149P3HIGHCVSS 7.5≥ 8.0.0, ≤ 8.1.2≥ 9.0.0, ≤ 9.1.02021-11-03

CVE-2021-37149 [HIGH] CWE-20 CVE-2021-37149: Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacke Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.

nvd

CVE-2021-37148P3HIGHCVSS 7.5≥ 8.0.0, ≤ 8.1.2≥ 9.0.0, ≤ 9.0.12021-11-03

CVE-2021-37148 [HIGH] CWE-20 CVE-2021-37148: Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacke Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.0.1.

nvd

CVE-2021-37147P3HIGHCVSS 7.5≥ 8.0.0, ≤ 8.1.2≥ 9.0.0, ≤ 9.1.02021-11-03

CVE-2021-37147 [HIGH] CWE-20 CVE-2021-37147: Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacke Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.

nvd

CVE-2015-5168P3CRITICALCVSS 9.8v5.3.0v5.3.12017-09-13

CVE-2015-5168 [CRITICAL] CVE-2015-5168: Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5 Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5206.

nvd

CVE-2015-5206P3CRITICALCVSS 9.8v5.3.0v5.3.12017-09-13

CVE-2015-5206 [CRITICAL] CVE-2015-5206: Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x b Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.

nvd

CVE-2021-32565P3HIGHCVSS 7.5≥ 7.0.0, ≤ 7.1.12≥ 8.0.0, ≤ 8.1.1+1 more2021-06-29

CVE-2021-32565 [HIGH] CWE-444 CVE-2021-32565: Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smug Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

nvd

CVE-2020-17508P3HIGHCVSS 7.5≥ 6.0.0, ≤ 6.2.3≥ 7.0.0, ≤ 7.1.11+1 more2021-01-11

CVE-2020-17508 [HIGH] CVE-2020-17508: The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgra The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.

nvd

CVE-2022-31778P3HIGHCVSS 7.5≥ 8.0.0, ≤ 8.1.4≥ 9.0.0, ≤ 9.1.22022-08-10

CVE-2022-31778 [HIGH] CWE-20 CVE-2022-31778: Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic S Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.

nvd

CVE-2025-49763P3HIGHCVSS 7.5≥ 9.0.0, < 9.2.11≥ 10.0.0, < 10.0.62025-06-19

CVE-2025-49763 [HIGH] CWE-400 CVE-2025-49763: ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory con ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10. Users are recommended to

nvd

CVE-2019-10079P3HIGHCVSS 7.5fixed in 7.1.7≥ 8.0.0, < 8.0.42019-10-22

CVE-2019-10079 [HIGH] CWE-770 CVE-2019-10079: Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traf Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions.

nvd

CVE-2021-27737P3HIGHCVSS 7.5v9.0.02021-05-14

CVE-2021-27737 [HIGH] CVE-2021-27737: Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin. Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.

nvd

CVE-2021-32566P3HIGHCVSS 7.5≥ 7.0.0, ≤ 7.1.12≥ 8.0.0, ≤ 8.1.1+1 more2021-06-30

CVE-2021-32566 [HIGH] CWE-20 CVE-2021-32566: Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

nvd

CVE-2021-32567P3HIGHCVSS 7.5≥ 7.0.0, ≤ 7.1.12≥ 8.0.0, ≤ 8.1.1+1 more2021-06-30

CVE-2021-32567 [HIGH] CWE-20 CVE-2021-32567: Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

nvd

CVE-2023-33933P3HIGHCVSS 7.5≥ 8.0.0, < 8.1.7≥ 9.0.0, < 9.2.12023-06-14

CVE-2023-33933 [HIGH] CWE-200 CVE-2023-33933: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundati Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions

nvd

CVE-2023-41752P3HIGHCVSS 7.5≥ 8.0.0, < 8.1.9≥ 9.0.0, < 9.2.32023-10-17

CVE-2023-41752 [HIGH] CWE-200 CVE-2023-41752: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.Th Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.

nvd

CVE-2021-41585P3HIGHCVSS 7.5≥ 8.0.0, ≤ 8.1.2≥ 9.0.0, ≤ 9.1.02021-11-03

CVE-2021-41585 [HIGH] CWE-20 CVE-2021-41585: Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server all Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections. This issue affects Apache Traffic Server 5.0.0 to 9.1.0.

nvd

CVE-2022-47184P3HIGHCVSS 7.5≥ 8.0.0, < 8.1.7≥ 9.0.0, < 9.2.12023-06-14

CVE-2022-47184 [HIGH] CWE-200 CVE-2022-47184: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundati Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.

nvd

CVE-2018-11783P3HIGHCVSS 7.5≥ 6.0.0, ≤ 6.0.3≥ 7.0.0, ≤ 7.1.5+1 more2019-03-07

CVE-2018-11783 [HIGH] CWE-200 CVE-2018-11783: sslheaders plugin extracts information from the client certificate and sets headers in the request b sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.

nvd

CVE-2020-17509P3HIGHCVSS 7.5≥ 6.0.0, ≤ 6.2.3≥ 7.0.0, ≤ 7.1.10+1 more2021-01-11

CVE-2020-17509 [HIGH] CWE-444 CVE-2020-17509: ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.

nvd

← Previous3 / 5Next →