traffic server · threatengine.sh

Home/Product/apache traffic server

Product

apache traffic server

83 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

>= 9.0.0 and < 9.2.13

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: fro

>= 9.0.0 and < 9.2.13

A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 th

>= 9.0.0 and < 9.2.11

ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instruct

>= 9.0.0 and < 9.2.11

ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a

>= 9.0.0 and < 9.2.10

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server:

>= 10.0.0 and < 10.0.4

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.

>= 9.0.0 and < 9.2.9

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.

>= 9.0.0 and < 9.2.9

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.

>= 9.0.0 and < 9.2.9

Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through

>= 6.0.0 and <= 6.2.3

In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow. This could lead to r

>= 10.0.0 and < 10.0.2

Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server:

>= 9.0.0 and < 9.2.6

Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: fro

>= 8.0.0 and <= 8.1.11

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.

>= 8.0.0 and < 8.1.11

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue aff

>= 8.0.0 and < 8.1.11

Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smugglin

>= 8.0.0 and < 8.1.11

Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin serve

>= 8.0.0 and < 8.1.10

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 thro

>= 8.0.0 and < 8.1.9

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffi

>= 9.0.0 and < 9.2.3

Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Se

>= 8.0.0 and < 8.1.9

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams q

>= 8.0.0 and <= 8.1.7

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Serv

>= 8.0.0 and <= 8.1.7

Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects

>= 8.0.0 and < 8.1.7

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This

>= 8.0.0 and < 8.1.7

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.con

>= 8.0.0 and < 8.1.7

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This

>= 8.0.0 and <= 8.1.5

Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cros

>= 8.0.0 and < 8.1.6

Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue

>= 8.0.0 and < 8.1.6

Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker t

>= 8.0.0 and <= 8.1.4

Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests.

>= 8.0.0 and <= 8.1.4

Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests.

>= 8.0.0 and <= 8.1.4

Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to po

>= 8.0.0 and <= 8.1.4

Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid hea

>= 8.0.0 and < 8.1.5

Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle

>= 8.0.0 and <= 8.1.4

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources.

>= 8.0.0 and <= 8.1.0

Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the

>= 8.0.0 and <= 8.1.3

Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid reques

>= 8.0.0 and <= 8.1.2

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traff

>= 8.0.0 and <= 8.1.2

Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the se

>= 8.0.0 and <= 8.0.8

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. Th

>= 8.0.0 and <= 8.1.2

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This is

>= 8.0.0 and <= 8.1.2

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This is

>= 8.0.0 and <= 8.1.2

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This is

>= 7.0.0 and <= 7.1.12

Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.

>= 7.0.0 and <= 7.1.12

Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affect

>= 7.0.0 and <= 7.1.12

Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affect

>= 7.0.0 and <= 7.1.12

Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affec

>= 7.0.0 and <= 7.1.12

Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affec

Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.

>= 6.0.0 and <= 6.2.3

ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable th

>= 6.0.0 and <= 6.2.3

The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server vers

>= 6.0.0 and <= 6.2.3

Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames

>= 6.0.0 and <= 6.2.3

Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.

>= 6.0.0 and <= 6.2.3

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and T

>= 6.0.0 and <= 6.2.3

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and c

>= 6.0.0 and <= 6.2.3

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and s

Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the nu

>= 6.0.0 and <= 6.2.3

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker se

>= 6.0.0 and <= 6.2.3

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. Th

>= 6.0.0 and <= 6.2.3

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stre

>= 6.0.0 and <= 6.2.3

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a s

>= 6.0.0 and <= 6.2.3

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a numb

>= 6.0.0 and <= 6.2.3

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates mul

>= 6.0.0 and <= 6.2.3

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continua

>= 6.0.0 and <= 6.2.3

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading

>= 6.0.0 and <= 6.0.3

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of t

>= 6.0.0 and <= 6.2.2

Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow acces

>= 6.0.0 and <= 6.2.2

A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolv

>= 6.0.0 and <= 6.2.2

When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can ca

>= 6.0.0 and <= 6.2.2

There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic S

>= 6.0.0 and <= 6.2.2

Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apa

>= 5.2.0 and <= 5.3.2

There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshak

There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding.

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (

Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly t

Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact

Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and at

Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.

Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.

Apache Traffic Server before 5.1.2 allows remote attackers to cause a denial of service via unspecified vectors, related to intern

Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact

Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows rem

Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs

Buffer overflow in traffic_manager for Inktomi Traffic Server 4.0.18 through 5.2.2, Traffic Edge 1.1.2 and 1.5.0, and Media-IXT 3.

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin