Apache Traffic Server

HTTP/2 HPACK dynamic table desynchronization in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) exposes a premature-state-update flaw in header compression logic. An unauthenticated remote attacker can trigger an HPACK encode failure, leaving the server's encoder table out of sync with the peer decoder's table and corrupting all subsequent header blocks transmitted on that HTTP/2 connection. No public exploit has been identified at time of analysis; the AC:H rating indicates reliable triggering requires specific conditions, and CISA KEV does not list this vulnerability.

Server-Side Request Forgery amplification in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to bypass the configured redirect-follow limit when a plugin resets the internal retry counter, letting a single request fan out into a large chain of proxy-originated requests. The CVSS 4.0 base score is 8.2 (High), reflecting high impact on availability rather than data disclosure, with an attack requirement (AT:P) tied to specific plugin behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Buffer overrun in the Apache Traffic Server multiplexer plugin's chunk-decode logic allows network-adjacent attackers who can influence upstream origin responses to cause denial of service across versions 8.0.0 through 10.1.3. The flaw is classified as CWE-787 (Out-of-bounds Write) and is constrained to availability impact only - no code execution or data exposure is indicated. No public exploit or CISA KEV listing has been identified, and the CVSS 3.7 Low score reflects meaningful real-world limitations, primarily the high attack complexity imposed by the upstream-input dependency.

Cache poisoning and content-type confusion in the Apache Traffic Server webp_transform plugin allows remote clients to induce the proxy to decode images unsafely and store mislabeled, cacheable responses that are then served to other users. Affected releases span the 8.x (through 8.1.9), 9.x (through 9.2.14), and 10.x (through 10.1.3) branches when the optional webp_transform plugin is enabled. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided, so risk here is driven by the CVSS 8.2 (CVSS 4.0) rating rather than observed exploitation.

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a use-after-free (CWE-416) in the intercept plugin, allowing a remote attacker to crash or destabilize the proxy server. The flaw carries a CVSS 4.0 base score of 8.2, driven entirely by high availability impact with no confidentiality or integrity effect, and exploitation depends on a specific attack condition (AT:P) rather than being trivially reproducible. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy or corrupt memory by triggering the plugin's cookie-manipulation and CIDR condition-matching logic. The flaw affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and is reachable over the network without authentication (PR:N) when a vulnerable header_rewrite ruleset is deployed. No public exploit identified at time of analysis; the primary consequence is denial of service (VA:H) with limited information exposure (VC:L).

Denial of service in Apache Traffic Server's prefetch plugin allows remote attackers to crash the caching proxy by supplying malicious input that the plugin fails to validate. Affected releases span the 8.x (8.0.0-8.1.9), 9.x (9.0.0-9.2.14), and 10.x (10.0.0-10.1.3) branches, and exploitation impacts only availability with no data exposure or code execution. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 8.2.

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from the ts_lua plugin mishandling initialization, transform context, and per-instance state, allowing remote unauthenticated attackers to exhaust or corrupt resource state and crash or hang the proxy (CVSS 4.0 base 8.2, availability-only impact). Exploitation carries an attack requirement (AT:P), meaning a specific condition beyond the attacker's control must hold, and only deployments that actually load the ts_lua scripting plugin are affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; treat it as a serviceability/uptime risk to Lua-enabled ATS proxies.

Denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) lets remote attackers crash the proxy by sending crafted input to the uri_signing or url_sig plugins, which recurse or copy unbounded data onto the stack until it is exhausted (CWE-121 stack-based buffer overflow). Only deployments that have loaded and enabled one of these URL-signing plugins are exposed; the impact is availability-only, with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor CVSS 4.0 score of 8.2 reflects easy unauthenticated network reach against affected edge nodes.

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-based buffer overflow in the txn_box plugin, which copies attacker-controlled input onto the stack without adequate bounds checking. Remote attackers reaching an ATS instance that loads the txn_box transaction-manipulation plugin can crash the server process; the CVSS 4.0 vector (8.2) scores the impact as availability-only (VA:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Stack-based buffer overflow and integer overflow in Apache Traffic Server's regex_remap plugin expose production proxy deployments to high-impact compromise via crafted substitution input. Versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are all affected, with confidentiality, integrity, and availability fully at risk. No public exploit identified at time of analysis, though the network-exploitable nature and full-triad impact make patching urgent for any deployment relying on regex_remap for URL rewriting.

Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers to trigger unbounded recursion while the plugin fetches attacker-controlled URLs, exhausting server resources. It affects Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 when the ESI plugin is enabled. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows remote attackers to trigger out-of-bounds writes, use-after-free conditions, and path traversal, primarily resulting in denial of service and partial integrity impact against the caching proxy. The CVSS 4.0 score of 8.3 (High) reflects a network-reachable, no-privilege attack whose success depends on a specific attack requirement (AT:P), such as a Cripts-based configuration being in use. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory leak in the HostDB code path that processes DNS SRV records, allowing remote attackers to progressively exhaust proxy memory and degrade or crash the service. The CVSS 4.0 vector (8.2, VA:H) points to an availability impact rather than the information disclosure implied by the vendor tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free and time-of-check/time-of-use race, primarily crashing the proxy (high availability impact) with secondary low-level confidentiality and integrity exposure. It affects the 8.x, 9.x, and 10.x branches up to 8.1.9, 9.2.14, and 10.1.3, and is fixed in 9.2.15 and 10.1.4. Reported by Apache with a CVSS 4.0 score of 8.3; no public exploit identified at time of analysis and it is not on CISA KEV.

Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows remote unauthenticated attackers to crash the proxy or corrupt its internal state by abusing how on-disk cache fields and object lifetimes are deserialized and managed. The flaw is a CWE-502 untrusted-deserialization class issue tied to the disk cache subsystem; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 score of 8.3 is driven by high availability impact and low integrity impact with no confidentiality exposure.

Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents of dynamically minted TLS certificates by controlling the client SNI value, affecting ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3. Because the plugin trusts attacker-supplied SNI to drive certificate creation (CWE-295), an unauthenticated remote party can influence which identities the proxy vouches for, undermining TLS trust. No public exploit identified at time of analysis, though the vendor-scored CVSS 4.0 base is 8.4 (high).

Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated attackers to crash the proxy by triggering NULL pointer dereferences and dangling references during TLS and SNI processing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a network-reachable, low-complexity availability impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is Apache-reported and patched in 9.2.15 and 10.1.4.

Out-of-bounds read in Apache Traffic Server's DNS answer parser (CWE-125) allows unauthenticated remote attackers - or adversaries capable of influencing DNS responses - to leak partial heap memory contents or crash the ATS process, affecting all three active release branches (8.x, 9.x, 10.x). The CVSS 6.5 Medium rating reflects no authentication barrier and no user interaction required, though impact is limited to partial confidentiality and availability loss with no integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis, but the network attack surface is broad given that every proxied request triggers DNS resolution.

Access control bypass in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to defeat IP-based access restrictions, both on Unix Domain Socket (UDS) listeners and through faulty ACL matching logic. Because ATS commonly fronts internal origin servers and management endpoints, bypassing these IP allow/deny lists can expose protected backend resources that operators believed were network-restricted. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the fix is vendor-confirmed in the Apache advisory.

Denial-of-service (and potential memory-corruption) in Apache Traffic Server arises from mishandling of PROXY protocol input, where malformed port fields are truncated and cause a stack buffer overflow (CWE-121). Affected releases span the 8.x, 9.x, and 10.x branches (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), and remote attackers can crash the proxy when it is configured to accept PROXY protocol connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor scores the impact as availability-only (CVSS 4.0 base 8.2).

Cross-connection information disclosure in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote unauthenticated attackers to receive data belonging to other clients because the proxy improperly reuses upstream server sessions and tunnels. Because the scope changes across trust boundaries, one client can be served another client's response data, making this a confidentiality-critical issue in a shared caching/proxy tier. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation is timing/condition dependent (CVSS AC:H).

Port-based access-control bypass in Apache Traffic Server stems from URL and userinfo mis-parsing that causes the proxy to evaluate ACL rules against an incorrect port value, allowing restricted backend ports to be reached. All three maintained release branches are affected - 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 - meaning the majority of deployed ATS instances are vulnerable. No public exploit or active exploitation has been identified at time of analysis, but the Changed scope (S:C) in the CVSS vector signals that successful exploitation crosses the proxy-to-backend boundary, amplifying real-world impact beyond the ATS process itself.

Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy silently truncates over-long HTTP header names, causing two distinct header names to alias to the same value. A network attacker can exploit this desynchronization to smuggle requests past the proxy and bypass security or routing policy. No public exploit has been identified at time of analysis, but the CVSS 9.3 rating and CWE-444 classification mark this as a high-priority proxy integrity flaw affecting a core CDN/caching component.

Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers corrupt memory by sending crafted headers to the proxy. It affects the 8.x, 9.x (through 9.2.14) and 10.x (through 10.1.3) branches, carries a high CVSS of 8.9 with a scope-change flag, and can lead to high integrity and availability impact. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the memory-corruption class makes it a strong patching priority.

Improper TLS certificate validation in Apache Traffic Server (ATS) versions 9.0.0-9.2.14 and 10.0.0-10.1.3 allows multiplexed HTTP/2 origin connections to be reused for requests targeting hostnames not covered by the existing connection's server certificate. When ATS coalesces HTTP/2 connections to origin servers, it omits the check confirming the server certificate's Subject Alternative Names cover the new request's hostname, meaning traffic may be silently routed over a connection authenticated for a different host. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.2.15 and 10.1.4.

Memory-exhaustion denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy drops its per-stream buffer cap while dechunking HTTP/2 or HTTP/3 responses. A remote, unauthenticated attacker acting as a deliberately slow client can force unbounded buffering and exhaust server memory, degrading or crashing the caching proxy. This is a pure availability issue (CWE-400) with no confidentiality or integrity impact; no public exploit has been identified at time of analysis.

HTTP/2-to-HTTP/1 protocol conversion in Apache Traffic Server 10.0.0-10.1.3 forwards origin HTTP/2 trailers to downstream HTTP/1 clients without the required chunked transfer encoding framing, enabling HTTP response smuggling. The CVSS 8.3 Scope:Changed rating reflects that exploitation impacts downstream HTTP/1 clients architecturally separate from ATS itself, with potential for cache poisoning, response injection, and limited information disclosure. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.

Memory corruption in Apache Traffic Server during HPACK/XPACK header decoding exposes affected deployments to denial of service. Versions spanning the 8.x, 9.x, and 10.x release lines are affected, with unauthenticated remote attackers able to craft malformed compressed headers that trigger an integer overflow (CWE-190), corrupting server memory. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 5.9 Medium, reflecting that while no authentication is required, elevated attack complexity limits opportunistic mass exploitation; no public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.

Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated attackers crash the proxy or exhaust its resources by sending abusive HTTP/2 framing and flow-control sequences. The flaw is availability-only (no data disclosure or code execution), carries a CVSS 4.0 base score of 8.7, and has no public exploit identified at time of analysis. The Apache HTTP Server project has released fixed builds (9.2.15 and 10.1.4).

HTTP request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) lets remote attackers desynchronize proxy/backend request parsing because the server fails to reject the Transfer-Encoding header on inbound HTTP/2 requests. When ATS downgrades those HTTP/2 requests to HTTP/1.1 for origin servers, the improper Transfer-Encoding directive creates a parsing discrepancy that enables downgrade request smuggling. No public exploit identified at time of analysis and it is not listed in CISA KEV, but this is a well-understood smuggling primitive tagged by the reporter for information disclosure.

Request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to desynchronize the proxy from backend origin servers by sending malformed chunked-transfer-encoded messages, per Apache advisory and NVD. Successful exploitation lets an attacker poison caches, bypass access controls, or disclose another client's information as tagged by the reporting source. No public exploit identified at time of analysis and the flaw is not in CISA KEV.

Denial-of-service (and potential memory corruption) in Apache Traffic Server affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 when redirect following is enabled. The proxy copies the client-supplied Host header into a fixed-size stack buffer without bounds checking during redirect handling, so an over-long Host header overflows the stack and crashes the process. There is no public exploit identified at time of analysis, and the vendor-assessed impact is limited to availability (CVSS 4.0 base 8.2).

HTTP request smuggling in Apache Traffic Server allows unauthenticated remote attackers to interfere with how the proxy and backend servers interpret HTTP request boundaries, enabling cache poisoning and limited information disclosure. Versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 are confirmed affected per Apache advisory. The Scope Changed (S:C) CVSS metric reflects that exploitation crosses the proxy boundary to impact downstream backend systems. No public exploit code or CISA KEV listing has been identified at time of analysis.

Improper input validation in Apache Traffic Server versions 9.2.0-9.2.14 and 10.1.0-10.1.3 lets remote attackers send malformed input that the proxy fails to validate, allowing manipulation of the integrity of downstream/backend traffic (e.g. request smuggling or response manipulation against systems behind the proxy). The CVSS 4.0 score is 7.7 (High), driven entirely by subsequent-system integrity impact (SI:H) with no confidentiality or availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unanchored regular expression matching in Apache Traffic Server exposes a high-severity bypass that allows remote unauthenticated attackers to circumvent regex-based access controls, potentially leaking protected content (C:H) and enabling limited unauthorized writes (I:L). All 9.0.x through 9.2.14 and 10.0.x through 10.1.3 deployments that rely on regex-driven rules for routing, ACL, or header policy enforcement are at risk. No public exploit code has been identified at time of analysis, and CISA has not listed this in KEV, but the low-complexity, unauthenticated network attack path makes it a realistic opportunistic target for any actor aware of the flaw.

Access control bypass in Apache Traffic Server versions 9.0.0 through 9.1.14 and 10.0.0 through 10.1.3 lets remote unauthenticated attackers subvert authorization enforcement at the proxy, tagged by Apache as an authentication bypass (CWE-284). Because Traffic Server acts as a caching/reverse proxy, the flaw's impact lands on backend systems it fronts rather than on the proxy process itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High).

Apache Traffic Server versions 9.0.0-9.2.12 and 10.0.0-10.1.1 are vulnerable to HTTP request smuggling through malformed chunked transfer encoding, allowing attackers to bypass security controls and smuggle malicious requests. The vulnerability stems from improper parsing of chunked messages (CWE-444: Inconsistent Interpretation of HTTP Requests) and affects all deployments using these versions as reverse proxies or intermediaries. Apache has released patched versions 9.2.13 and 10.1.2; no public exploit code or active exploitation has been reported at the time of analysis.

Denial of service in Apache Traffic Server 9.0.0-9.2.12 and 10.0.0-10.1.1 caused by improper handling of POST requests that triggers a server crash under specific conditions. The vulnerability affects all instances of the affected versions and requires no authentication or special privileges to exploit. Vendor-released patches are available in versions 9.2.13 and 10.1.2.