Apache Traffic Server
- Software type
- Proxy server
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/13/2026, Apache Traffic Server recorded 16 security vulnerabilities in the last 90 days, of which 14 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache Traffic Server and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-112381Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked responseCVE-2026-111817Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeoutCVE-2026-111816Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-outCVE-2026-111815Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcementCVE-2026-111814Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-112381Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response | Exploitation statusNot exploited | FixNo |
| SeverityHigh |
CVE-2026-111817Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityMedium |
|---|
CVE-2026-111816Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out | Exploitation statusNot confirmed | FixYes | Published10/21/2026 | SeverityCritical |
|---|
CVE-2026-111815Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityHigh |
|---|
CVE-2026-111814Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityHigh |
|---|
CVE-2026-111813Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration | Exploitation statusNot confirmed | FixYes | Published10/21/2026 | SeverityCritical |
|---|
CVE-2026-111812Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityHigh |
|---|
CVE-2026-111811Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityCritical |
|---|
CVE-2026-111810Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service | Exploitation statusNot exploited | FixNo | Published10/21/2026 | SeverityHigh |
|---|
CVE-2026-111809Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityMedium |
|---|
CVE-2026-111808Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityHigh |
|---|
CVE-2026-111805Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion | Exploitation statusNot exploited | FixYes | Published10/21/2026 | SeverityHigh |
|---|
CVE-2026-111804Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs | Exploitation statusNot confirmed | FixYes | Published10/21/2026 | SeverityHigh |
|---|
CVE-2025-55702Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request | Exploitation statusNot confirmed | FixYes | Published10/21/2026 | SeverityHigh |
|---|
CVE-2025-31699Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling | Exploitation statusNot confirmed | FixYes | Published10/21/2026 | SeverityCritical |
|---|
CVE-2026-102795Apache Traffic Server: SNI to Host header matching policy is not properly enforced | Exploitation statusNot exploited | FixYes | Published10/02/2026 | SeverityHigh |
|---|
CVE-2026-65325Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityMedium |
|---|
CVE-2026-65324Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-65100Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityMedium |
|---|
CVE-2026-58189Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58188Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58187Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityMedium |
|---|
CVE-2026-58186Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58185Apache Traffic Server: Use-after-free in the intercept plugin | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58184Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58183Apache Traffic Server: prefetch plugin can crash on attacker-influenced input | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58182Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58181Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58180Apache Traffic Server: txn_box plugin overflows the stack from attacker input | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58179Apache Traffic Server: regex_remap plugin overflows the stack from attacker input | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityCritical |
|---|
CVE-2026-58178Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58177Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58175Apache Traffic Server: HostDB SRV handling leaks memory | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58164Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58163Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58162Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58161Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityCritical |
|---|
CVE-2026-58160Apache Traffic Server: Out-of-bounds reads while parsing DNS responses | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityMedium |
|---|
CVE-2026-58159Apache Traffic Server: Listener and ACL handling allow access-control bypass | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58158Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58157Apache Traffic Server: Improper server-session reuse can expose data across client connections | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityMedium |
|---|
CVE-2026-58156Apache Traffic Server: URL and port parsing errors allow access-control bypass | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityMedium |
|---|
CVE-2026-58155Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityCritical |
|---|
CVE-2026-58154Apache Traffic Server: Memory-safety errors in MIME and header parsing | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityCritical |
|---|
CVE-2026-58153Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityMedium |
|---|
CVE-2026-58152Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityMedium |
|---|
CVE-2026-58151Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-58150Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-57834Apache Traffic Server: Malformed chunked message body allows request smuggling | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
CVE-2026-41920Apache Traffic Server: SNI to Host header matching policy is not properly enforced | Exploitation statusNot exploited | FixYes | Published07/29/2026 | SeverityHigh |
|---|
111 Results | Page 1 of 3