Traffic Server vulnerabilities

54 known vulnerabilities in Traffic Server from Apache. 54 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache Traffic Server: Server-Side Request Forgery

  CVE-2026-58189Jul 29, 2026Apache

  Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommen

• 8.2 High severity

  Apache Traffic Server: Out-of-bounds Write

  CVE-2026-58188Jul 29, 2026Apache

  Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to versi

• 7.5 High severity

  Apache Traffic Server: Out-of-bounds Write

  CVE-2026-58187Jul 29, 2026Apache

  The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are r

• 7.5 High severity

  The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled…

  CVE-2026-58186Jul 29, 2026Apache

  The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to

• 9.8 Critical severity

  Apache Traffic Server: Use After Free

  CVE-2026-58185Jul 29, 2026Apache

  The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix

• 7.5 High severity

  Apache Traffic Server: Out-of-bounds Write

  CVE-2026-58184Jul 29, 2026Apache

  The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users

• 7.5 High severity

  The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input.

  CVE-2026-58183Jul 29, 2026Apache

  The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to versi

• 8.6 High severity

  Apache Traffic Server: Uncontrolled Resource Consumption

  CVE-2026-58182Jul 29, 2026Apache

  The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to u

• 7.5 High severity

  Apache Traffic Server: Stack-based Buffer Overflow

  CVE-2026-58181Jul 29, 2026Apache

  The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upg

• 7.5 High severity

  Apache Traffic Server: Stack-based Buffer Overflow

  CVE-2026-58180Jul 29, 2026Apache

  The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version

• 9.8 Critical severity

  Apache Traffic Server: Stack-based Buffer Overflow

  CVE-2026-58179Jul 29, 2026Apache

  The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade

• 7.5 High severity

  Apache Traffic Server: Uncontrolled Recursion

  CVE-2026-58178Jul 29, 2026Apache

  The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to v

• 9.8 Critical severity

  Apache Traffic Server: Out-of-bounds Write

  CVE-2026-58177Jul 29, 2026Apache

  The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue.

• 7.5 High severity

  Apache Traffic Server: Missing Release of Memory after Effective Lifetime

  CVE-2026-58175Jul 29, 2026Apache

  Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which

• 7.5 High severity

  Apache Traffic Server: Use After Free

  CVE-2026-58164Jul 29, 2026Apache

  Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to

• 9.1 Critical severity

  Apache Traffic Server: Deserialization of Untrusted Data

  CVE-2026-58163Jul 29, 2026Apache

  Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgra

• 10.0 Critical severity

  Apache Traffic Server: Improper Certificate Validation

  CVE-2026-58162Jul 29, 2026Apache

  The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgr

• 7.5 High severity

  Apache Traffic Server: NULL Pointer Dereference

  CVE-2026-58161Jul 29, 2026Apache

  Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade

• 8.2 High severity

  Apache Traffic Server: Incorrect Authorization

  CVE-2026-58159Jul 29, 2026Apache

  Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade t

• 8.7 High severity

  Apache Traffic Server: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-58157Jul 29, 2026Apache

  Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended t

• 7.5 High severity

  Apache Traffic Server: Uncontrolled Resource Consumption

  CVE-2026-65324Jul 29, 2026Apache

  Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 1

• 9.3 Critical severity

  Apache Traffic Server: Inconsistent Interpretation of HTTP Requests

  CVE-2026-58155Jul 29, 2026Apache

  Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recomm

• 8.9 High severity

  Apache Traffic Server: Out-of-bounds Write

  CVE-2026-58154Jul 29, 2026Apache

  Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade

• 8.3 High severity

  Apache Traffic Server: Inconsistent Interpretation of HTTP Requests

  CVE-2026-58153Jul 29, 2026Apache

  Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or

• 7.5 High severity

  Apache Traffic Server: Uncontrolled Resource Consumption

  CVE-2026-58151Jul 29, 2026Apache

  Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended

• 10.0 Critical severity

  Apache Traffic Server: Inconsistent Interpretation of HTTP Requests

  CVE-2026-58150Jul 29, 2026Apache

  Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended

• 10.0 Critical severity

  Apache Traffic Server: Inconsistent Interpretation of HTTP Requests

  CVE-2026-57834Jul 29, 2026Apache

  Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or

• 9.3 Critical severity

  Apache Traffic Server: Improper Access Control

  CVE-2026-41920Jul 29, 2026Apache

  Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

• 9.1 Critical severity

  Improper Input Validation vulnerability in Apache Traffic Server.

  CVE-2026-33267Jul 29, 2026Apache

  Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

• 7.5 High severity

  Apache Traffic Server: Uncontrolled Resource Consumption

  CVE-2026-59173Jul 18, 2026Apache

  Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2. Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue.

• 7.5 High severity

  Apache Traffic Server: Inconsistent Interpretation of HTTP Requests

  CVE-2025-65114Apr 2, 2026Apache

  Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1. Users are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue

• 7.5 High severity

  Apache Traffic Server: Always-Incorrect Control Flow Implementation

  CVE-2025-58136Apr 2, 2026Apache

  A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A worka

• 7.5 High severity

  Apache Traffic Server: Uncontrolled Resource Consumption

  CVE-2025-49763Jun 19, 2025Apache

  ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traff

• 7.5 High severity

  Apache Traffic Server: Improper Access Control

  CVE-2025-31698Jun 19, 2025Apache

  ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to a

• 7.5 High severity

  Apache Traffic Server: Inconsistent Interpretation of HTTP Requests

  CVE-2024-53868Apr 3, 2025Apache

  Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issu

• 9.1 Critical severity

  Apache Traffic Server: Unchecked Return Value

  CVE-2024-50306Nov 14, 2024ApacheEPSS 1.57%

  Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the

• 7.5 High severity

  Valid Host header field can cause Apache Traffic Server to crash on some platforms.

  CVE-2024-50305Nov 14, 2024Apache

  Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the

• 7.5 High severity

  Improper Input Validation vulnerability in Apache Traffic Server.

  CVE-2024-38479Nov 14, 2024Apache

  Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not

• 8.2 High severity

  Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force…

  CVE-2024-35296Jul 26, 2024ApacheEPSS 1.08%

  Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11

• 7.5 High severity

  Apache Traffic Server: Inconsistent Interpretation of HTTP Requests

  CVE-2024-35161Jul 26, 2024Apache

  Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 thr