Debian Trafficserver vulnerabilities

CVE-2015-5206 [CRITICAL] CVE-2015-5206: trafficserver - Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic S... Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168. Scope: local bookworm: resolved (fixed in 6.0.0-1) bullseye: resolved (fixed in 6.0.0-1) sid: resolved (fixed in 6.0.0-1)

CVE-2015-5168 [CRITICAL] CVE-2015-5168: trafficserver - Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic S... Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5206. Scope: local bookworm: resolved (fixed in 6.0.0-1) bullseye: resolved (fixed in 6.0.0-1) sid: resolved (fixed in 6.0.0-1)

CVE-2021-32565 [HIGH] CVE-2021-32565: trafficserver - Invalid values in the Content-Length header sent to Apache Traffic Server allows... Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1. Scope: local bookworm: resolved (fixed in 8.1.1+ds-1.1) bullseye: resolved (fixed in 8.1.1+ds-1.1) sid: resolved (fixed in 8.1.1+ds-1.1)

CVE-2020-17508 [HIGH] CVE-2020-17508: trafficserver - The ATS ESI plugin has a memory disclosure vulnerability. If you are running the... The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected. Scope: local bookworm: resolved (fixed in 8.1.1+ds-1) bullseye: resolved (fixed in 8.1.1+ds-1) sid: resolved (fixed in 8.1.1+ds-1)

CVE-2022-31778 [HIGH] CVE-2022-31778: trafficserver - Improper Input Validation vulnerability in handling the Transfer-Encoding header... Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2. Scope: local bookworm: resolved (fixed in 9.1.3+ds-1) bullseye: resolved (fixed in 8.1.5+ds-1~deb11u1) sid: resolved (fixed in 9.1.3+ds-1)

CVE-2025-49763 [HIGH] CVE-2025-49763: trafficserver - ESI plugin does not have the limit for maximum inclusion depth, and that allows ... ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10. Users are recommended to upgrade to

CVE-2019-10079 [HIGH] CVE-2019-10079: trafficserver - Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier ver... Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions. Scope: local bookworm: resolved (fixed in 8.0.5+ds-1) bullseye: resolved (fixed in

CVE-2021-32566 [HIGH] CVE-2021-32566: trafficserver - Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allow... Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1. Scope: local bookworm: resolved (fixed in 8.1.1+ds-1.1) bullseye: resolved (fixed in 8.1.1+ds-1.1) sid: resolved (fixed in 8.1.1+ds-1.1)

CVE-2021-32567 [HIGH] CVE-2021-32567: trafficserver - Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allow... Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1. Scope: local bookworm: resolved (fixed in 8.1.1+ds-1.1) bullseye: resolved (fixed in 8.1.1+ds-1.1) sid: resolved (fixed in 8.1.1+ds-1.1)

CVE-2023-33933 [HIGH] CVE-2023-33933: trafficserver - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions Scope: local bookworm: resolved (fixed in 9.2.0+ds-2+deb12u1) bul

CVE-2023-41752 [HIGH] CVE-2023-41752: trafficserver - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue. Scope: local bookworm: resolved (fixed in 9.2.3+ds-1+deb12u1) bullseye: resolved (fixed

CVE-2022-47184 [HIGH] CVE-2022-47184: trafficserver - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0. Scope: local bookworm: resolved (fixed in 9.2.0+ds-2+deb12u1) bullseye: resolved (fixed in 8.1.7+ds-1~deb11u1) sid: resolved (fixed in 9.2.1+ds-1)

CVE-2018-11783 [HIGH] CVE-2018-11783: trafficserver - sslheaders plugin extracts information from the client certificate and sets head... sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1. Scope: local bookworm: resolved (fixed in 8.0.2+ds-1) bu

CVE-2020-17509 [HIGH] CVE-2020-17509: trafficserver - ATS negative cache option is vulnerable to a cache poisoning attack. If you have... ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected. Scope: local bookworm: resolved (fixed in 8.1.1+ds-1) bullseye: resolved (fixed in 8.1.1+ds-1) sid: resolved (fixed in 8.1.1+ds-1)

CVE-2022-47185 [HIGH] CVE-2022-47185: trafficserver - Improper input validation vulnerability on the range header in Apache Software F... Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1. Scope: local bookworm: resolved (fixed in 9.2.3+ds-1+deb12u1) bullseye: resolved (fixed in 8.1.9+ds-1~deb11u1) sid: resolved (fixed in 9.2.2+ds-1)

CVE-2022-32749 [HIGH] CVE-2022-32749: trafficserver - Improper Check for Unusual or Exceptional Conditions vulnerability handling requ... Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions. This issue affects Apache Traffic Server: from 8.0.0 through 9.1.3. Scope: local bookworm: resolved (fixed in 9.1.4+ds-1) bullseye: resolved (fixed in 8.1.6+ds-1~deb11u1) sid: resolved (f

CVE-2014-3525 [CRITICAL] CVE-2014-3525: trafficserver - Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before... Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks. Scope: local bookworm: resolved (fixed in 5.0.1-1) bullseye: resolved (fixed in 5.0.1-1) sid: resolved (fixed in 5.0.1-1)

CVE-2020-9494 [HIGH] CVE-2020-9494: trafficserver - Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vul... Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread. Scope: local bookworm: resolved (fixed in 8.0.8+ds-1) bullseye: resolved (fixed in 8.0.8+ds-1) sid: resolved (fixed in 8.0.8+ds-1)

CVE-2018-8004 [MEDIUM] CVE-2018-8004: trafficserver - There are multiple HTTP smuggling and cache poisoning issues when clients making... There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. Scope: local bookworm:

CVE-2024-50305 [HIGH] CVE-2024-50305: trafficserver - Valid Host header field can cause Apache Traffic Server to crash on some platfor... Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue. Scope: local bookworm: resolved (fixed in 9.2.5+ds-0+deb12u2) bullseye: open sid: open