Apache Traffic Server
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Apache Traffic Server.
By the Year
In 2026 there have been 56 vulnerabilities in Apache Traffic Server with an average score of 7.8 out of ten. Last year, in 2025 Traffic Server had 7 security vulnerabilities published. That is, 49 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 56 | 7.82 |
| 2025 | 7 | 0.00 |
| 2024 | 8 | 7.91 |
| 2023 | 8 | 7.70 |
| 2022 | 11 | 7.16 |
| 2021 | 14 | 7.93 |
| 2020 | 5 | 9.80 |
| 2019 | 10 | 7.50 |
| 2018 | 7 | 7.50 |
It may take a day or so for new Traffic Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Apache Traffic Server Security Vulnerabilities
Apache Traffic Server <=9.2.15,10.1.4,10.2.0 ptr deref crash on POST halfclose
CVE-2026-112381
5.9 - Medium
- October 21, 2026
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
NULL Pointer Dereference
Apache Traffic Server DoS via dropped chunked trailers (10.1.4)
CVE-2026-111817
5.3 - Medium
- October 21, 2026
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled. This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Resource Exhaustion
Apache Traffic Server origin_server_auth plugin auth header spoofing (<=10.2.0)
CVE-2026-111812
10 - Critical
- October 21, 2026
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
AuthZ
Apache Traffic Server tsmemcache plugin unauth read/write cache (10.2.0)
CVE-2026-111811
9 - Critical
- October 21, 2026
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Missing Authentication for Critical Function
Apache Traffic Server HEAD request smuggling (up to 10.2.0)
CVE-2026-111809
9.3 - Critical
- October 21, 2026
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
HTTP Request Smuggling
Apache Traffic Server <9.2.16/10.1.5/10.2.1 Log DoS via Header Stripping
CVE-2026-111810
7.5 - High
- October 21, 2026
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Resource Exhaustion
Apache Traffic Server TLS resume SNI bypasses client cert verify (10.2.0)
CVE-2026-111815
10 - Critical
- October 21, 2026
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Improper Certificate Validation
Apache Traffic Server TLS Session Reuse Bypass (9.2.15, 10.1.4, 10.2.0)
CVE-2026-111814
10 - Critical
- October 21, 2026
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Improper Certificate Validation
Apache Traffic Server HTTP/2 DATA frame DoS (10.2.0)
CVE-2026-111808
8.6 - High
- October 21, 2026
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Integer underflow
Apache Traffic Server HTTP/2 CL truncation DoS (pre 9.2.16,10.1.5,10.2.1)
CVE-2026-111805
8.6 - High
- October 21, 2026
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Resource Exhaustion
Apache Traffic Server <9.2.16,10.1.5,10.2.1 Cache Poison via TE Chunked 302
CVE-2026-111816
9.3 - Critical
- October 21, 2026
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and response-framing desync. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
HTTP Request Smuggling
Apache Traffic Server 8-10.2.0 Vulnerable to 100-continue Request Smuggling
CVE-2025-55702
8.7 - High
- October 21, 2026
When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
HTTP Request Smuggling
Apache Traffic Server: Request Smuggling via Origin Connection Reuse (10.2.0)
CVE-2025-31699
8.9 - High
- October 21, 2026
Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
HTTP Request Smuggling
Apache Traffic Server <10.1.5 UAF in exp WASM plugin (metric ID)
CVE-2026-111804
8.2 - High
- October 21, 2026
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 10.1.5 or 10.2.1, which fix the issue.
Dangling pointer
Apache Traffic Server magick plugin RCE before 9.2.16/10.1.5/10.2.1
CVE-2026-111813
10 - Critical
- October 21, 2026
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Argument Injection
Apache Traffic Server HPACK sync bug 8.x-10.1.3
CVE-2026-65100
4.8 - Medium
- July 29, 2026
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Incorrect Behavior Order
Apache Traffic Server SSRF Amplification via RedirectLimit Bypass (8.0.010.1.3)
CVE-2026-58189
7.5 - High
- July 29, 2026
Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
SSRF
Apache Traffic Server 8.0.0-10.1.3 Experimental Plugins: Mem-Safety LBRB Errors
CVE-2026-58188
8.2 - High
- July 29, 2026
Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Memory Corruption
Apache Traffic Server Chunk-Decode Buffer Overflow in Multi-Plugin (10.1.3)
CVE-2026-58187
3.7 - Low
- July 29, 2026
The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Memory Corruption
Apache Traffic Server 8.x-10.x webp_transform Unsafely Decode & Cacheable Response
CVE-2026-58186
7.5 - High
- July 29, 2026
The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Improper Input Validation
Apache Traffic Server 8-10 Use-After-Free in Intercept Plugin
CVE-2026-58185
5.9 - Medium
- July 29, 2026
The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Dangling pointer
Apache Traffic Server header_rewrite Crash/Memory Corruption Before 10.1.4
CVE-2026-58184
8.2 - High
- July 29, 2026
The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Memory Corruption
Apache TS Prefetch Plug Crash v8.0.0-8.1.9 & v9.0.0-9.2.14 & v10.0.0-10.1.3
CVE-2026-58183
5.9 - Medium
- July 29, 2026
The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Improper Input Validation
Apache Traffic Server TS_LUA init/ctx/state bug (v8-10)
CVE-2026-58182
8.6 - High
- July 29, 2026
The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Resource Exhaustion
Apache TS uri_signing/url_sig Stack Crash CVE-2026-58181 8.0.0-10.1.3
CVE-2026-58181
7.5 - High
- July 29, 2026
The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Stack Overflow
Stack Overflow in Traffic Server txn_box (<=9.2.14)/<=10.1.3, 8.x-8.1.9
CVE-2026-58180
7.5 - High
- July 29, 2026
The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Stack Overflow
Stack Overflow in regex_remap Plugin on Apache Traffic Server (8.0-10.1)
CVE-2026-58179
8.1 - High
- July 29, 2026
The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Stack Overflow
Apache TS ESI: Recursion Fetch Attacker URLs (v8-8.1.9/9-9.2.14/10-10.1.3)
CVE-2026-58178
7.5 - High
- July 29, 2026
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Stack Exhaustion
Apache Traffic Server 10.010.1.3 Cripts: OOB Write, Path Traversal, UAF
CVE-2026-58177
8.1 - High
- July 29, 2026
The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue.
Memory Corruption
Apache Traffic Server Memory Leak (HostDB SRV) up to 10.1.3
CVE-2026-58175
7.5 - High
- July 29, 2026
Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Memory Leak
Apache Traffic Server 8.0-10.1.3 UA/TOU in remap config
CVE-2026-58164
7.5 - High
- July 29, 2026
Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Dangling pointer
Apache Traffic Server Cache Field Corruption Crash (v8.0.0-10.1.3)
CVE-2026-58163
7.5 - High
- July 29, 2026
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Marshaling, Unmarshaling
Apache Traffic Server SNI-based Cert Injection <8.0.0-10.1.3
CVE-2026-58162
10 - Critical
- July 29, 2026
The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Improper Certificate Validation
Apache Traffic Server Null Deref Crash in TLS/SNI (8.0.010.1.3)
CVE-2026-58161
7.5 - High
- July 29, 2026
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
NULL Pointer Dereference
TrfServ OOB DNS Read CVE-2026-58160 (8.08.1.9, 9.09.2.14, 10.010.1.3)
CVE-2026-58160
6.5 - Medium
- July 29, 2026
Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Out-of-bounds Read
Apache Traffic Server IP ACL Bypass on UDS Listeners (fix in 9.2.15 /10.1.4)
CVE-2026-58159
8.2 - High
- July 29, 2026
Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AuthZ
Apache Traffic Server PROXY Protocol Stack Overflow 8.0-10.1 fixed 9.2.15/10.1.4
CVE-2026-58158
5.9 - Medium
- July 29, 2026
Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Stack Overflow
Apache TS Improper Session/Tunnel Reuse Exposes Data (8.0.010.1.3)
CVE-2026-58157
8.7 - High
- July 29, 2026
Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Information Disclosure
Apache Traffic Server Port Parsing Bypass (8.0.08.1.9, 9.0.09.2.14, 10.0.010.1.3)
CVE-2026-58156
4.9 - Medium
- July 29, 2026
Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
AuthZ
Apache Traffic Server Header Alias Bypass (8.0-10.1.3)
CVE-2026-58155
9.3 - Critical
- July 29, 2026
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
HTTP Request Smuggling
Apache Traffic Server OOB Write in header parsing v810
CVE-2026-58154
8.9 - High
- July 29, 2026
Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Memory Corruption
Apache Traffic Server HTTP/2 conn. reuse lacking cert check v9.0-10.1
CVE-2026-65325
4.8 - Medium
- July 29, 2026
Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Improper Certificate Validation
Apache Traffic Server 8.x-10.1.3: HTTP/2/3 Dechunking Causing Mem Exhaustion
CVE-2026-65324
7.5 - High
- July 29, 2026
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Resource Exhaustion
Apache Traffic Server 10.0.0-10.1.3 HTTP/2 trailers -> HTTP/1 chunk framing bug
CVE-2026-58153
8.3 - High
- July 29, 2026
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
HTTP Request Smuggling
Apache Traffic Server Int Overrun in HPACK/XPACK Headers 8.0.0-8.1.9/9.0.0-9.2.14/10.0.0-10.1.3
CVE-2026-58152
5.9 - Medium
- July 29, 2026
Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Integer Overflow or Wraparound
Apache Traffic Server 8.0.0-10.1.3: Crash via Abusive HTTP/2 Framing
CVE-2026-58151
7.5 - High
- July 29, 2026
Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Resource Exhaustion
Traffic Server: HTTP/2 Transfer-Encoding downgrade smuggling, v8.010.1.3
CVE-2026-58150
10 - Critical
- July 29, 2026
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
HTTP Request Smuggling
Apache Traffic Server (ATS) Chunked Req Smuggling 8.0.010.1.3
CVE-2026-57834
10 - Critical
- July 29, 2026
Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
HTTP Request Smuggling
Apache Traffic Server Host Header stack overflow in redirect (8.0.0-10.1.3)
CVE-2026-33930
5.9 - Medium
- July 29, 2026
Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is enabled. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Stack Overflow
Apache Traffic Server HTTP Request Smuggling (9.0.0-9.2.14, 10.0.0-10.1.3)
CVE-2026-24033
7.2 - High
- July 29, 2026
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
HTTP Request Smuggling
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Apache Traffic Server or by Apache? Click the Watch button to subscribe.
