Apache Traffic Server
- Software type
- Proxy server
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/19/2026, Apache Traffic Server recorded 39 security vulnerabilities in the last 90 days, of which 29 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache Traffic Server and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-102795Apache Traffic Server: SNI to Host header matching policy is not properly enforcedCVE-2026-65100Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encodeCVE-2026-58189Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplificationCVE-2026-58188Apache Traffic Server: Memory-safety and limit-bypass errors across experimental pluginsCVE-2026-58187Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-102795Apache Traffic Server: SNI to Host header matching policy is not properly enforced | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-65100Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityMedium |
|---|
CVE-2026-58189Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58188Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58187Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityMedium |
|---|
CVE-2026-58186Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58185Apache Traffic Server: Use-after-free in the intercept plugin | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58184Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58183Apache Traffic Server: prefetch plugin can crash on attacker-influenced input | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58182Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
96 Results | Page 1 of 10