Apache Traffic Server vulnerabilities

Latest Apache Traffic Server CVEs

Newest publication first · page 3 of 5

1. CVE-2026-24033 Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing

   Published 2026-07-29

   Medium·CVSS 6.9 EPSS 0.57%

   Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4,...

2. CVE-2026-33267 Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata

   Published 2026-07-29

   High·CVSS 7.7 EPSS 0.60%

   Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

3. CVE-2026-22068 Apache Traffic Server: Regex mappings match with malicious domain names

   Published 2026-07-29

   Medium·CVSS 6.9 EPSS 0.61%

   Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.

4. CVE-2026-41920 Apache Traffic Server: SNI to Host header matching policy is not properly enforced

   Published 2026-07-29

   High·CVSS 7.0 EPSS 0.53%

   Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

5. CVE-2026-59173 Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions

   Published 2026-07-18

   High·CVSS 7.5 EPSS 0.74%

   Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2. Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue.

6. CVE-2025-65114 Apache Traffic Server: Malformed chunked message body allows request smuggling

   Published 2026-04-02

   High·CVSS 7.5 EPSS 0.45%

   Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1. Users are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue.

7. CVE-2025-58136 Apache Traffic Server: A simple legitimate POST request causes a crash

   Published 2026-04-02

   High·CVSS 7.5 EPSS 0.70%

   A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12. Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue. A workaround for older vers...

8. CVE-2025-31698 Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL

   Published 2025-06-19

   High·CVSS 7.5 EPSS 0.55%

   ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to accept PROXY protocol...

9. CVE-2025-49763 Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin

   Published 2025-06-19

   High·CVSS 7.5 EPSS 0.74%

   ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0...

10. CVE-2024-53868 Apache Traffic Server: Malformed chunked message body allows request smuggling

    Published 2025-04-03

    High·CVSS 7.5 EPSS 0.67%

    Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issue.

11. CVE-2024-38311 Apache Traffic Server: Request smuggling via pipelining after a chunked message body

    Published 2025-03-06

    Medium·CVSS 6.3 EPSS 0.91%

    Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

12. CVE-2024-56195 Apache Traffic Server: Intercept plugins are not access controlled

    Published 2025-03-06

    Medium·CVSS 6.3 EPSS 0.78%

    Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

13. CVE-2024-56196 Apache Traffic Server: ACL is not fully compatible with older versions

    Published 2025-03-06

    Medium·CVSS 6.3 EPSS 0.78%

    Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 10.0.4, which fixes the issue.

14. CVE-2024-56202 Apache Traffic Server: Expect header field can unreasonably retain resource

    Published 2025-03-06

    Medium·CVSS 4.3 EPSS 0.87%

    Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue.

15. CVE-2024-50306 Apache Traffic Server: Server process can fail to drop privilege

    Published 2024-11-14

    Critical·CVSS 9.1 EPSS 1.6%

    Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the issue.

16. CVE-2024-50305 Apache Traffic Server: Valid Host field value can cause crashes

    Published 2024-11-14

    High·CVSS 7.5 EPSS 0.93%

    Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

17. CVE-2024-38479 Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack

    Published 2024-11-14

    High·CVSS 7.5 EPSS 0.82%

    Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

18. CVE-2023-38522 Apache Traffic Server: Incomplete field name check allows request smuggling

    Published 2024-07-26

    High·CVSS 7.5 EPSS 0.99%

    Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traff...

19. CVE-2024-35296 Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests

    Published 2024-07-26

    High·CVSS 8.2 EPSS 1.1%

    Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fix...

20. CVE-2024-35161 Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling

    Published 2024-07-26

    High·CVSS 7.5 EPSS 0.97%

    Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9....

21. CVE-2024-31309 Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack

    Published 2024-04-10

    High·CVSS 7.5 EPSS 92.5%

    HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number...

22. CVE-2023-39456 Apache Traffic Server: Malformed http/2 frames can cause an abort

    Published 2023-10-17

    High·CVSS 7.5 EPSS 58.3%

    Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue.

23. CVE-2023-41752 Apache Traffic Server: s3_auth plugin problem with hash calculation

    Published 2023-10-17

    High·CVSS 7.5 EPSS 1.6%

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.

24. CVE-2023-33934 Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies

    Published 2023-08-09

    Critical·CVSS 9.1 EPSS 1.6%

    Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.

25. CVE-2022-47185 Apache Traffic Server: Invalid Range header causes a crash

    Published 2023-08-09

    High·CVSS 7.5 EPSS 2.0%

    Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.