Apache Traffic Server
Monthly
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be crashed by a remote, unauthenticated attacker through a null pointer dereference (CWE-476) while proxying chunked origin responses. The race requires a client POST request to be torn down via TCP half-close at the moment ATS reparses a chunked origin response from a reentrant write-ready callback, so it is timing-dependent and typically needs repeated attempts; impact is limited to denial of service (crash), with no code execution, data disclosure, or integrity loss. No public exploit was identified at time of analysis, and vendor-released fixed versions are 9.2.16, 10.1.5, and 10.2.1.
Unauthenticated remote clients can force Apache Traffic Server's origin_server_auth plugin to sign attacker-chosen AWS request headers with the proxy's own AWS credentials, potentially allowing access to or modification of origin resources permitted to that identity. The issue affects ATS 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0, but only installations using the non-default plugin to sign origin requests with AWS credentials are exposed. The vendor rates it High with a CVSS 4.0 base score of 7.0; no public exploit identified at time of analysis.
Unauthenticated network access to the shared proxy cache is possible in Apache Traffic Server deployments that load and enable the experimental tsmemcache plugin, allowing remote attackers to read, modify, and delete cached objects without credentials. Affected releases span 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0; the exposure is gated by the plugin being explicitly enabled and its memcache-style interface being network-reachable, since it is not active in a default installation. No public exploit code or confirmed active exploitation was identified at time of analysis, though the CVSS 4.0 base score of 9.4 and the unauthenticated nature of the interface once exposed make this a high-priority fix for anyone running the plugin.
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be driven into a denial-of-service condition through log amplification: each internal '@' header stripped from a request causes an unthrottled diagnostic log line, so requests carrying many such headers generate disproportionate log writes. The issue is network-reachable and unauthenticated, with high availability impact when log storage, rotation, or retention is constrained; no public exploit identified at time of analysis.
Client-certificate authentication bypass in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0) lets an unauthenticated remote attacker resume a previously negotiated TLS session against an SNI virtual host that is configured with the verify_client STRICT policy, reaching backends that should have demanded a client certificate. The attacker only needs to first establish a resumable session on a virtual host that does not require client certificates, then resume it against the protected host; deployments that do not use verify_client STRICT, or that do not share session state across SNI hosts, are not exposed. No public exploit code or active exploitation has been identified at time of analysis, and the practical risk is concentrated in multi-tenant TLS-termination front ends that mix mutual-TLS and non-mTLS virtual hosts on the same instance.
TLS client-certificate cross-contamination in Apache Traffic Server 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 lets an outbound (origin-facing) transaction configured to present one client certificate instead reuse a pooled TLS session that was authenticated with a different client certificate, so the origin may see, authorize, and log the wrong client identity. The issue only manifests where ATS is configured for outbound mutual TLS with more than one distinct client certificate while the default outbound session-sharing/pooling policy is left enabled; deployments without outbound client certificates, with a single client identity, or with session sharing disabled are not affected. Apache assigned the maximum CVSS 3.1 score of 10.0, while this assessment scores it AV:N/AC:H because triggering the wrong reuse depends on session-pool state and timing rather than an attacker-injected payload; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. Vendor-released patches exist in 9.2.16, 10.1.5, and 10.2.1.
Malformed padded HTTP/2 DATA frames sent to Apache Traffic Server 8.x, 9.x, or 10.x proxies that forward to HTTP/1.1 origins can trigger an integer underflow and exhaust the origin's worker pool, causing denial of service for proxied traffic. The issue is remotely reachable without authentication or user interaction when HTTP/2 is enabled on the client-facing listener (CVSS 4.0 AV:N/AC:L/PR:N/UI:N; CVSS 3.1 S:C/A:H), and the availability impact is scored against the downstream origin rather than the ATS process itself. No public exploit identified at time of analysis.
Denial of service in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 allows unauthenticated remote attackers to exhaust a downstream HTTP/1.1 origin's worker pool by sending a truncated HTTP/2 Content-Length value that ATS mishandles when relaying the request. The issue is limited to proxy deployments where ATS accepts HTTP/2 client connections and forwards traffic to an HTTP/1.1 origin; no public exploit code or confirmed active exploitation was identified at time of analysis.
Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0) allows a malformed 302 response that should have been rejected as a parse error to pass the rejection path through the Transfer-Encoding: chunked carve-out, so the proxy stores and serves a response that different peers interpret differently. Per the CVSS vector the issue is remote and unauthenticated (AV:N/AC:L/PR:N/UI:N, scope changed, I:H/C:L), enabling cache poisoning and response-framing desync against deployments acting as caching or forwarding proxies. No public exploit code or CISA KEV entry is associated at time of analysis; the practical precondition is that a suitable malformed upstream response actually traverses the proxy. Fixed versions 9.2.16, 10.1.5, and 10.2.1 are published by the vendor.
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that have loaded the experimental WebAssembly plugin and trigger a use-after-free in the plugin's transaction-close handler, producing memory corruption that primarily threatens availability (high) with a limited integrity impact. The same plugin also passes unvalidated guest-supplied metric IDs straight into ATS's internal stats API, a path that requires the attacker to control or supply the wasm guest module. Exposure is limited to deployments that explicitly enable this non-default experimental plugin on versions 10.0.0 through 10.1.4 or 10.2.0; no public exploit identified at time of analysis.
Apache Traffic Server versions 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 ship an experimental 'magick' plugin that, in its default unsigned configuration, passes client-controlled data into ImageMagick 'convert' arguments, letting remote attackers inject command-line options (CWE-88 argument injection) with no authentication or user interaction. Because the plugin is experimental and not enabled by default, only deployments that deliberately loaded it without enabling request signing are exposed; those that are exposed face a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with scope change and full confidentiality, integrity, and availability impact, since injected arguments can drive ImageMagick into reading or writing arbitrary files or executing delegated commands. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, but the impact on a vulnerable, enabled instance is total, and upgrading to 9.2.16, 10.1.5, or 10.2.1 is recommended.
Improper access control in Apache Traffic Server 9.0.0-9.2.14 and 10.0.0-10.1.3 allows unauthenticated remote requests that should have been denied to be forwarded to backend systems the proxy is meant to protect, yielding high confidentiality and integrity impact on those subsequent systems (SC:H/SI:H) with no direct impact on the Traffic Server host itself (VC:N/VI:N/VA:N). Exploitation is conditional, not routine: the CVSS 4.0 vector carries AT:P, meaning a specific attack requirement outside the attacker's direct control must be satisfied before a request succeeds, and this is corroborated by the independent assessment as a genuine but conditional risk rather than an urgent emergency. No public exploit code or confirmed active exploitation was identified at time of analysis; fixed versions are 9.2.15 and 10.1.4, and this CVE supersedes CVE-2026-41920, whose record understated the 9.x affected range as 9.0.0-9.1.14.
Server-Side Request Forgery amplification in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to bypass the configured redirect-follow limit when a plugin resets the internal retry counter, letting a single request fan out into a large chain of proxy-originated requests. The CVSS 4.0 base score is 8.2 (High), reflecting high impact on availability rather than data disclosure, with an attack requirement (AT:P) tied to specific plugin behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cache poisoning and content-type confusion in the Apache Traffic Server webp_transform plugin allows remote clients to induce the proxy to decode images unsafely and store mislabeled, cacheable responses that are then served to other users. Affected releases span the 8.x (through 8.1.9), 9.x (through 9.2.14), and 10.x (through 10.1.3) branches when the optional webp_transform plugin is enabled. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided, so risk here is driven by the CVSS 8.2 (CVSS 4.0) rating rather than observed exploitation.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a use-after-free (CWE-416) in the intercept plugin, allowing a remote attacker to crash or destabilize the proxy server. The flaw carries a CVSS 4.0 base score of 8.2, driven entirely by high availability impact with no confidentiality or integrity effect, and exploitation depends on a specific attack condition (AT:P) rather than being trivially reproducible. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy or corrupt memory by triggering the plugin's cookie-manipulation and CIDR condition-matching logic. The flaw affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and is reachable over the network without authentication (PR:N) when a vulnerable header_rewrite ruleset is deployed. No public exploit identified at time of analysis; the primary consequence is denial of service (VA:H) with limited information exposure (VC:L).
Denial of service in Apache Traffic Server's prefetch plugin allows remote attackers to crash the caching proxy by supplying malicious input that the plugin fails to validate. Affected releases span the 8.x (8.0.0-8.1.9), 9.x (9.0.0-9.2.14), and 10.x (10.0.0-10.1.3) branches, and exploitation impacts only availability with no data exposure or code execution. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 8.2.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from the ts_lua plugin mishandling initialization, transform context, and per-instance state, allowing remote unauthenticated attackers to exhaust or corrupt resource state and crash or hang the proxy (CVSS 4.0 base 8.2, availability-only impact). Exploitation carries an attack requirement (AT:P), meaning a specific condition beyond the attacker's control must hold, and only deployments that actually load the ts_lua scripting plugin are affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; treat it as a serviceability/uptime risk to Lua-enabled ATS proxies.
Denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) lets remote attackers crash the proxy by sending crafted input to the uri_signing or url_sig plugins, which recurse or copy unbounded data onto the stack until it is exhausted (CWE-121 stack-based buffer overflow). Only deployments that have loaded and enabled one of these URL-signing plugins are exposed; the impact is availability-only, with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor CVSS 4.0 score of 8.2 reflects easy unauthenticated network reach against affected edge nodes.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-based buffer overflow in the txn_box plugin, which copies attacker-controlled input onto the stack without adequate bounds checking. Remote attackers reaching an ATS instance that loads the txn_box transaction-manipulation plugin can crash the server process; the CVSS 4.0 vector (8.2) scores the impact as availability-only (VA:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Stack-based buffer overflow and integer overflow in Apache Traffic Server's regex_remap plugin expose production proxy deployments to high-impact compromise via crafted substitution input. Versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are all affected, with confidentiality, integrity, and availability fully at risk. No public exploit identified at time of analysis, though the network-exploitable nature and full-triad impact make patching urgent for any deployment relying on regex_remap for URL rewriting.
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers to trigger unbounded recursion while the plugin fetches attacker-controlled URLs, exhausting server resources. It affects Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 when the ESI plugin is enabled. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows remote attackers to trigger out-of-bounds writes, use-after-free conditions, and path traversal, primarily resulting in denial of service and partial integrity impact against the caching proxy. The CVSS 4.0 score of 8.3 (High) reflects a network-reachable, no-privilege attack whose success depends on a specific attack requirement (AT:P), such as a Cripts-based configuration being in use. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory leak in the HostDB code path that processes DNS SRV records, allowing remote attackers to progressively exhaust proxy memory and degrade or crash the service. The CVSS 4.0 vector (8.2, VA:H) points to an availability impact rather than the information disclosure implied by the vendor tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free and time-of-check/time-of-use race, primarily crashing the proxy (high availability impact) with secondary low-level confidentiality and integrity exposure. It affects the 8.x, 9.x, and 10.x branches up to 8.1.9, 9.2.14, and 10.1.3, and is fixed in 9.2.15 and 10.1.4. Reported by Apache with a CVSS 4.0 score of 8.3; no public exploit identified at time of analysis and it is not on CISA KEV.
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows remote unauthenticated attackers to crash the proxy or corrupt its internal state by abusing how on-disk cache fields and object lifetimes are deserialized and managed. The flaw is a CWE-502 untrusted-deserialization class issue tied to the disk cache subsystem; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 score of 8.3 is driven by high availability impact and low integrity impact with no confidentiality exposure.
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents of dynamically minted TLS certificates by controlling the client SNI value, affecting ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3. Because the plugin trusts attacker-supplied SNI to drive certificate creation (CWE-295), an unauthenticated remote party can influence which identities the proxy vouches for, undermining TLS trust. No public exploit identified at time of analysis, though the vendor-scored CVSS 4.0 base is 8.4 (high).
Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated attackers to crash the proxy by triggering NULL pointer dereferences and dangling references during TLS and SNI processing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a network-reachable, low-complexity availability impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is Apache-reported and patched in 9.2.15 and 10.1.4.
Access control bypass in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to defeat IP-based access restrictions, both on Unix Domain Socket (UDS) listeners and through faulty ACL matching logic. Because ATS commonly fronts internal origin servers and management endpoints, bypassing these IP allow/deny lists can expose protected backend resources that operators believed were network-restricted. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the fix is vendor-confirmed in the Apache advisory.
Denial-of-service (and potential memory-corruption) in Apache Traffic Server arises from mishandling of PROXY protocol input, where malformed port fields are truncated and cause a stack buffer overflow (CWE-121). Affected releases span the 8.x, 9.x, and 10.x branches (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), and remote attackers can crash the proxy when it is configured to accept PROXY protocol connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor scores the impact as availability-only (CVSS 4.0 base 8.2).
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy silently truncates over-long HTTP header names, causing two distinct header names to alias to the same value. A network attacker can exploit this desynchronization to smuggle requests past the proxy and bypass security or routing policy. No public exploit has been identified at time of analysis, but the CVSS 9.3 rating and CWE-444 classification mark this as a high-priority proxy integrity flaw affecting a core CDN/caching component.
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers corrupt memory by sending crafted headers to the proxy. It affects the 8.x, 9.x (through 9.2.14) and 10.x (through 10.1.3) branches, carries a high CVSS of 8.9 with a scope-change flag, and can lead to high integrity and availability impact. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the memory-corruption class makes it a strong patching priority.
Memory-exhaustion denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy drops its per-stream buffer cap while dechunking HTTP/2 or HTTP/3 responses. A remote, unauthenticated attacker acting as a deliberately slow client can force unbounded buffering and exhaust server memory, degrading or crashing the caching proxy. This is a pure availability issue (CWE-400) with no confidentiality or integrity impact; no public exploit has been identified at time of analysis.
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated attackers crash the proxy or exhaust its resources by sending abusive HTTP/2 framing and flow-control sequences. The flaw is availability-only (no data disclosure or code execution), carries a CVSS 4.0 base score of 8.7, and has no public exploit identified at time of analysis. The Apache HTTP Server project has released fixed builds (9.2.15 and 10.1.4).
HTTP request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) lets remote attackers desynchronize proxy/backend request parsing because the server fails to reject the Transfer-Encoding header on inbound HTTP/2 requests. When ATS downgrades those HTTP/2 requests to HTTP/1.1 for origin servers, the improper Transfer-Encoding directive creates a parsing discrepancy that enables downgrade request smuggling. No public exploit identified at time of analysis and it is not listed in CISA KEV, but this is a well-understood smuggling primitive tagged by the reporter for information disclosure.
Request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to desynchronize the proxy from backend origin servers by sending malformed chunked-transfer-encoded messages, per Apache advisory and NVD. Successful exploitation lets an attacker poison caches, bypass access controls, or disclose another client's information as tagged by the reporting source. No public exploit identified at time of analysis and the flaw is not in CISA KEV.
Denial-of-service (and potential memory corruption) in Apache Traffic Server affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 when redirect following is enabled. The proxy copies the client-supplied Host header into a fixed-size stack buffer without bounds checking during redirect handling, so an over-long Host header overflows the stack and crashes the process. There is no public exploit identified at time of analysis, and the vendor-assessed impact is limited to availability (CVSS 4.0 base 8.2).
Improper input validation in Apache Traffic Server versions 9.2.0-9.2.14 and 10.1.0-10.1.3 lets remote attackers send malformed input that the proxy fails to validate, allowing manipulation of the integrity of downstream/backend traffic (e.g. request smuggling or response manipulation against systems behind the proxy). The CVSS 4.0 score is 7.7 (High), driven entirely by subsequent-system integrity impact (SI:H) with no confidentiality or availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Access control bypass in Apache Traffic Server versions 9.0.0 through 9.1.14 and 10.0.0 through 10.1.3 lets remote unauthenticated attackers subvert authorization enforcement at the proxy, tagged by Apache as an authentication bypass (CWE-284). Because Traffic Server acts as a caching/reverse proxy, the flaw's impact lands on backend systems it fronts rather than on the proxy process itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High).
Apache Traffic Server can be stalled by a crafted chunked HTTP transfer whose trailers ATS has been configured to strip: the proxy discards the trailer bytes but still waits for them, so the transaction hangs until the connection timeout expires. Versions 10.0.0 through 10.1.4 and 10.2.0 are exposed in their default configuration because proxy.config.http.drop_chunked_trailers is enabled by default in the 10.x line, while 8.1.11 and 9.2.5 through 9.2.15 are affected only where an operator has explicitly turned that setting on. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, availability-only Low), this is a modest denial-of-service issue that degrades individual proxied connections rather than the whole service; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited.
HTTP request smuggling in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0) lets unauthenticated remote attackers send HEAD requests carrying Content-Length or Transfer-Encoding headers to desynchronize HTTP message framing between ATS and an upstream or downstream agent. The scope-changed CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N) reflects high integrity impact - cache poisoning, request/response queue confusion, and possible access-control bypass - with limited confidentiality exposure; no public exploit code was identified at time of analysis. Vendor-released fixes are available in 9.2.16, 10.1.5, and 10.2.1.
HTTP request smuggling in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 allows attackers behind a front-end proxy that pools and reuses upstream connections to desynchronize responses and smuggle requests past that front end. The trigger is a client POST carrying 'Expect: 100-continue' when the origin responds before the request body is read, causing ATS to parse the unread body as the next request on the shared connection. Standalone ATS deployments, or those not fronted by a connection-reusing proxy, are not exploitable; no public exploit code or active exploitation was identified at time of analysis.
Request smuggling in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 allows remote unauthenticated attackers to have a later request read as leftover body data on a recycled origin connection, enabling access-control bypass, cross-user request disruption, and cache poisoning. The attacker must declare a body via Content-Length or Expect: 100-continue but never fully send it, then win a timing window while ATS returns the origin connection to its shared keep-alive pool. No public exploit has been identified at time of analysis, but the default configuration is affected and exploitation is probabilistic rather than guaranteed.
HTTP/2 HPACK dynamic table desynchronization in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) exposes a premature-state-update flaw in header compression logic. An unauthenticated remote attacker can trigger an HPACK encode failure, leaving the server's encoder table out of sync with the peer decoder's table and corrupting all subsequent header blocks transmitted on that HTTP/2 connection. No public exploit has been identified at time of analysis; the AC:H rating indicates reliable triggering requires specific conditions, and CISA KEV does not list this vulnerability.
Buffer overrun in the Apache Traffic Server multiplexer plugin's chunk-decode logic allows network-adjacent attackers who can influence upstream origin responses to cause denial of service across versions 8.0.0 through 10.1.3. The flaw is classified as CWE-787 (Out-of-bounds Write) and is constrained to availability impact only - no code execution or data exposure is indicated. No public exploit or CISA KEV listing has been identified, and the CVSS 3.7 Low score reflects meaningful real-world limitations, primarily the high attack complexity imposed by the upstream-input dependency.
Out-of-bounds read in Apache Traffic Server's DNS answer parser (CWE-125) allows unauthenticated remote attackers - or adversaries capable of influencing DNS responses - to leak partial heap memory contents or crash the ATS process, affecting all three active release branches (8.x, 9.x, 10.x). The CVSS 6.5 Medium rating reflects no authentication barrier and no user interaction required, though impact is limited to partial confidentiality and availability loss with no integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis, but the network attack surface is broad given that every proxied request triggers DNS resolution.
Cross-connection information disclosure in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote unauthenticated attackers to receive data belonging to other clients because the proxy improperly reuses upstream server sessions and tunnels. Because the scope changes across trust boundaries, one client can be served another client's response data, making this a confidentiality-critical issue in a shared caching/proxy tier. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation is timing/condition dependent (CVSS AC:H).
Port-based access-control bypass in Apache Traffic Server stems from URL and userinfo mis-parsing that causes the proxy to evaluate ACL rules against an incorrect port value, allowing restricted backend ports to be reached. All three maintained release branches are affected - 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 - meaning the majority of deployed ATS instances are vulnerable. No public exploit or active exploitation has been identified at time of analysis, but the Changed scope (S:C) in the CVSS vector signals that successful exploitation crosses the proxy-to-backend boundary, amplifying real-world impact beyond the ATS process itself.
Improper TLS certificate validation in Apache Traffic Server (ATS) versions 9.0.0-9.2.14 and 10.0.0-10.1.3 allows multiplexed HTTP/2 origin connections to be reused for requests targeting hostnames not covered by the existing connection's server certificate. When ATS coalesces HTTP/2 connections to origin servers, it omits the check confirming the server certificate's Subject Alternative Names cover the new request's hostname, meaning traffic may be silently routed over a connection authenticated for a different host. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.2.15 and 10.1.4.
HTTP/2-to-HTTP/1 protocol conversion in Apache Traffic Server 10.0.0-10.1.3 forwards origin HTTP/2 trailers to downstream HTTP/1 clients without the required chunked transfer encoding framing, enabling HTTP response smuggling. The CVSS 8.3 Scope:Changed rating reflects that exploitation impacts downstream HTTP/1 clients architecturally separate from ATS itself, with potential for cache poisoning, response injection, and limited information disclosure. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Memory corruption in Apache Traffic Server during HPACK/XPACK header decoding exposes affected deployments to denial of service. Versions spanning the 8.x, 9.x, and 10.x release lines are affected, with unauthenticated remote attackers able to craft malformed compressed headers that trigger an integer overflow (CWE-190), corrupting server memory. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 5.9 Medium, reflecting that while no authentication is required, elevated attack complexity limits opportunistic mass exploitation; no public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
HTTP request smuggling in Apache Traffic Server allows unauthenticated remote attackers to interfere with how the proxy and backend servers interpret HTTP request boundaries, enabling cache poisoning and limited information disclosure. Versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 are confirmed affected per Apache advisory. The Scope Changed (S:C) CVSS metric reflects that exploitation crosses the proxy boundary to impact downstream backend systems. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unanchored regular expression matching in Apache Traffic Server exposes a high-severity bypass that allows remote unauthenticated attackers to circumvent regex-based access controls, potentially leaking protected content (C:H) and enabling limited unauthorized writes (I:L). All 9.0.x through 9.2.14 and 10.0.x through 10.1.3 deployments that rely on regex-driven rules for routing, ACL, or header policy enforcement are at risk. No public exploit code has been identified at time of analysis, and CISA has not listed this in KEV, but the low-complexity, unauthenticated network attack path makes it a realistic opportunistic target for any actor aware of the flaw.
Apache Traffic Server versions 9.0.0-9.2.12 and 10.0.0-10.1.1 are vulnerable to HTTP request smuggling through malformed chunked transfer encoding, allowing attackers to bypass security controls and smuggle malicious requests. The vulnerability stems from improper parsing of chunked messages (CWE-444: Inconsistent Interpretation of HTTP Requests) and affects all deployments using these versions as reverse proxies or intermediaries. Apache has released patched versions 9.2.13 and 10.1.2; no public exploit code or active exploitation has been reported at the time of analysis.
Denial of service in Apache Traffic Server 9.0.0-9.2.12 and 10.0.0-10.1.1 caused by improper handling of POST requests that triggers a server crash under specific conditions. The vulnerability affects all instances of the affected versions and requires no authentication or special privileges to exploit. Vendor-released patches are available in versions 9.2.13 and 10.1.2.
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be crashed by a remote, unauthenticated attacker through a null pointer dereference (CWE-476) while proxying chunked origin responses. The race requires a client POST request to be torn down via TCP half-close at the moment ATS reparses a chunked origin response from a reentrant write-ready callback, so it is timing-dependent and typically needs repeated attempts; impact is limited to denial of service (crash), with no code execution, data disclosure, or integrity loss. No public exploit was identified at time of analysis, and vendor-released fixed versions are 9.2.16, 10.1.5, and 10.2.1.
Unauthenticated remote clients can force Apache Traffic Server's origin_server_auth plugin to sign attacker-chosen AWS request headers with the proxy's own AWS credentials, potentially allowing access to or modification of origin resources permitted to that identity. The issue affects ATS 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0, but only installations using the non-default plugin to sign origin requests with AWS credentials are exposed. The vendor rates it High with a CVSS 4.0 base score of 7.0; no public exploit identified at time of analysis.
Unauthenticated network access to the shared proxy cache is possible in Apache Traffic Server deployments that load and enable the experimental tsmemcache plugin, allowing remote attackers to read, modify, and delete cached objects without credentials. Affected releases span 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0; the exposure is gated by the plugin being explicitly enabled and its memcache-style interface being network-reachable, since it is not active in a default installation. No public exploit code or confirmed active exploitation was identified at time of analysis, though the CVSS 4.0 base score of 9.4 and the unauthenticated nature of the interface once exposed make this a high-priority fix for anyone running the plugin.
Apache Traffic Server 9.2.15, 10.1.4, and 10.2.0 can be driven into a denial-of-service condition through log amplification: each internal '@' header stripped from a request causes an unthrottled diagnostic log line, so requests carrying many such headers generate disproportionate log writes. The issue is network-reachable and unauthenticated, with high availability impact when log storage, rotation, or retention is constrained; no public exploit identified at time of analysis.
Client-certificate authentication bypass in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0) lets an unauthenticated remote attacker resume a previously negotiated TLS session against an SNI virtual host that is configured with the verify_client STRICT policy, reaching backends that should have demanded a client certificate. The attacker only needs to first establish a resumable session on a virtual host that does not require client certificates, then resume it against the protected host; deployments that do not use verify_client STRICT, or that do not share session state across SNI hosts, are not exposed. No public exploit code or active exploitation has been identified at time of analysis, and the practical risk is concentrated in multi-tenant TLS-termination front ends that mix mutual-TLS and non-mTLS virtual hosts on the same instance.
TLS client-certificate cross-contamination in Apache Traffic Server 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 lets an outbound (origin-facing) transaction configured to present one client certificate instead reuse a pooled TLS session that was authenticated with a different client certificate, so the origin may see, authorize, and log the wrong client identity. The issue only manifests where ATS is configured for outbound mutual TLS with more than one distinct client certificate while the default outbound session-sharing/pooling policy is left enabled; deployments without outbound client certificates, with a single client identity, or with session sharing disabled are not affected. Apache assigned the maximum CVSS 3.1 score of 10.0, while this assessment scores it AV:N/AC:H because triggering the wrong reuse depends on session-pool state and timing rather than an attacker-injected payload; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. Vendor-released patches exist in 9.2.16, 10.1.5, and 10.2.1.
Malformed padded HTTP/2 DATA frames sent to Apache Traffic Server 8.x, 9.x, or 10.x proxies that forward to HTTP/1.1 origins can trigger an integer underflow and exhaust the origin's worker pool, causing denial of service for proxied traffic. The issue is remotely reachable without authentication or user interaction when HTTP/2 is enabled on the client-facing listener (CVSS 4.0 AV:N/AC:L/PR:N/UI:N; CVSS 3.1 S:C/A:H), and the availability impact is scored against the downstream origin rather than the ATS process itself. No public exploit identified at time of analysis.
Denial of service in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 allows unauthenticated remote attackers to exhaust a downstream HTTP/1.1 origin's worker pool by sending a truncated HTTP/2 Content-Length value that ATS mishandles when relaying the request. The issue is limited to proxy deployments where ATS accepts HTTP/2 client connections and forwards traffic to an HTTP/1.1 origin; no public exploit code or confirmed active exploitation was identified at time of analysis.
Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0) allows a malformed 302 response that should have been rejected as a parse error to pass the rejection path through the Transfer-Encoding: chunked carve-out, so the proxy stores and serves a response that different peers interpret differently. Per the CVSS vector the issue is remote and unauthenticated (AV:N/AC:L/PR:N/UI:N, scope changed, I:H/C:L), enabling cache poisoning and response-framing desync against deployments acting as caching or forwarding proxies. No public exploit code or CISA KEV entry is associated at time of analysis; the practical precondition is that a suitable malformed upstream response actually traverses the proxy. Fixed versions 9.2.16, 10.1.5, and 10.2.1 are published by the vendor.
Unauthenticated remote attackers can drive HTTP transactions to completion against Apache Traffic Server instances that have loaded the experimental WebAssembly plugin and trigger a use-after-free in the plugin's transaction-close handler, producing memory corruption that primarily threatens availability (high) with a limited integrity impact. The same plugin also passes unvalidated guest-supplied metric IDs straight into ATS's internal stats API, a path that requires the attacker to control or supply the wasm guest module. Exposure is limited to deployments that explicitly enable this non-default experimental plugin on versions 10.0.0 through 10.1.4 or 10.2.0; no public exploit identified at time of analysis.
Apache Traffic Server versions 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 ship an experimental 'magick' plugin that, in its default unsigned configuration, passes client-controlled data into ImageMagick 'convert' arguments, letting remote attackers inject command-line options (CWE-88 argument injection) with no authentication or user interaction. Because the plugin is experimental and not enabled by default, only deployments that deliberately loaded it without enabling request signing are exposed; those that are exposed face a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with scope change and full confidentiality, integrity, and availability impact, since injected arguments can drive ImageMagick into reading or writing arbitrary files or executing delegated commands. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, but the impact on a vulnerable, enabled instance is total, and upgrading to 9.2.16, 10.1.5, or 10.2.1 is recommended.
Improper access control in Apache Traffic Server 9.0.0-9.2.14 and 10.0.0-10.1.3 allows unauthenticated remote requests that should have been denied to be forwarded to backend systems the proxy is meant to protect, yielding high confidentiality and integrity impact on those subsequent systems (SC:H/SI:H) with no direct impact on the Traffic Server host itself (VC:N/VI:N/VA:N). Exploitation is conditional, not routine: the CVSS 4.0 vector carries AT:P, meaning a specific attack requirement outside the attacker's direct control must be satisfied before a request succeeds, and this is corroborated by the independent assessment as a genuine but conditional risk rather than an urgent emergency. No public exploit code or confirmed active exploitation was identified at time of analysis; fixed versions are 9.2.15 and 10.1.4, and this CVE supersedes CVE-2026-41920, whose record understated the 9.x affected range as 9.0.0-9.1.14.
Server-Side Request Forgery amplification in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to bypass the configured redirect-follow limit when a plugin resets the internal retry counter, letting a single request fan out into a large chain of proxy-originated requests. The CVSS 4.0 base score is 8.2 (High), reflecting high impact on availability rather than data disclosure, with an attack requirement (AT:P) tied to specific plugin behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds write and limit-bypass flaws in several experimental plugins shipped with Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allow remote attackers to corrupt memory, with high confidentiality and availability impact and limited integrity impact. Exploitation is scoped to deployments that build and enable the affected experimental plugins rather than the default proxy core. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cache poisoning and content-type confusion in the Apache Traffic Server webp_transform plugin allows remote clients to induce the proxy to decode images unsafely and store mislabeled, cacheable responses that are then served to other users. Affected releases span the 8.x (through 8.1.9), 9.x (through 9.2.14), and 10.x (through 10.1.3) branches when the optional webp_transform plugin is enabled. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was provided, so risk here is driven by the CVSS 8.2 (CVSS 4.0) rating rather than observed exploitation.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a use-after-free (CWE-416) in the intercept plugin, allowing a remote attacker to crash or destabilize the proxy server. The flaw carries a CVSS 4.0 base score of 8.2, driven entirely by high availability impact with no confidentiality or integrity effect, and exploitation depends on a specific attack condition (AT:P) rather than being trivially reproducible. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory write in the Apache Traffic Server header_rewrite plugin allows remote attackers to crash the proxy or corrupt memory by triggering the plugin's cookie-manipulation and CIDR condition-matching logic. The flaw affects ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3, and is reachable over the network without authentication (PR:N) when a vulnerable header_rewrite ruleset is deployed. No public exploit identified at time of analysis; the primary consequence is denial of service (VA:H) with limited information exposure (VC:L).
Denial of service in Apache Traffic Server's prefetch plugin allows remote attackers to crash the caching proxy by supplying malicious input that the plugin fails to validate. Affected releases span the 8.x (8.0.0-8.1.9), 9.x (9.0.0-9.2.14), and 10.x (10.0.0-10.1.3) branches, and exploitation impacts only availability with no data exposure or code execution. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 8.2.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from the ts_lua plugin mishandling initialization, transform context, and per-instance state, allowing remote unauthenticated attackers to exhaust or corrupt resource state and crash or hang the proxy (CVSS 4.0 base 8.2, availability-only impact). Exploitation carries an attack requirement (AT:P), meaning a specific condition beyond the attacker's control must hold, and only deployments that actually load the ts_lua scripting plugin are affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; treat it as a serviceability/uptime risk to Lua-enabled ATS proxies.
Denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) lets remote attackers crash the proxy by sending crafted input to the uri_signing or url_sig plugins, which recurse or copy unbounded data onto the stack until it is exhausted (CWE-121 stack-based buffer overflow). Only deployments that have loaded and enabled one of these URL-signing plugins are exposed; the impact is availability-only, with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor CVSS 4.0 score of 8.2 reflects easy unauthenticated network reach against affected edge nodes.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a stack-based buffer overflow in the txn_box plugin, which copies attacker-controlled input onto the stack without adequate bounds checking. Remote attackers reaching an ATS instance that loads the txn_box transaction-manipulation plugin can crash the server process; the CVSS 4.0 vector (8.2) scores the impact as availability-only (VA:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Stack-based buffer overflow and integer overflow in Apache Traffic Server's regex_remap plugin expose production proxy deployments to high-impact compromise via crafted substitution input. Versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are all affected, with confidentiality, integrity, and availability fully at risk. No public exploit identified at time of analysis, though the network-exploitable nature and full-triad impact make patching urgent for any deployment relying on regex_remap for URL rewriting.
Denial of service in the Apache Traffic Server ESI (Edge Side Includes) plugin allows remote unauthenticated attackers to trigger unbounded recursion while the plugin fetches attacker-controlled URLs, exhausting server resources. It affects Apache Traffic Server 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 when the ESI plugin is enabled. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Memory corruption in the Cripts scripting framework of Apache Traffic Server (versions 10.0.0 through 10.1.3) allows remote attackers to trigger out-of-bounds writes, use-after-free conditions, and path traversal, primarily resulting in denial of service and partial integrity impact against the caching proxy. The CVSS 4.0 score of 8.3 (High) reflects a network-reachable, no-privilege attack whose success depends on a specific attack requirement (AT:P), such as a Cripts-based configuration being in use. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises from a memory leak in the HostDB code path that processes DNS SRV records, allowing remote attackers to progressively exhaust proxy memory and degrade or crash the service. The CVSS 4.0 vector (8.2, VA:H) points to an availability impact rather than the information disclosure implied by the vendor tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in Apache Traffic Server's remap configuration handling lets remote attackers trigger a use-after-free and time-of-check/time-of-use race, primarily crashing the proxy (high availability impact) with secondary low-level confidentiality and integrity exposure. It affects the 8.x, 9.x, and 10.x branches up to 8.1.9, 9.2.14, and 10.1.3, and is fixed in 9.2.15 and 10.1.4. Reported by Apache with a CVSS 4.0 score of 8.3; no public exploit identified at time of analysis and it is not on CISA KEV.
Denial-of-service and cache-integrity corruption in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows remote unauthenticated attackers to crash the proxy or corrupt its internal state by abusing how on-disk cache fields and object lifetimes are deserialized and managed. The flaw is a CWE-502 untrusted-deserialization class issue tied to the disk cache subsystem; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 4.0 score of 8.3 is driven by high availability impact and low integrity impact with no confidentiality exposure.
Improper certificate generation in the Apache Traffic Server certifier plugin lets remote attackers dictate the contents of dynamically minted TLS certificates by controlling the client SNI value, affecting ATS 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3. Because the plugin trusts attacker-supplied SNI to drive certificate creation (CWE-295), an unauthenticated remote party can influence which identities the proxy vouches for, undermining TLS trust. No public exploit identified at time of analysis, though the vendor-scored CVSS 4.0 base is 8.4 (high).
Remote denial of service in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3) allows unauthenticated attackers to crash the proxy by triggering NULL pointer dereferences and dangling references during TLS and SNI processing. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) reflects a network-reachable, low-complexity availability impact with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is Apache-reported and patched in 9.2.15 and 10.1.4.
Access control bypass in Apache Traffic Server (8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to defeat IP-based access restrictions, both on Unix Domain Socket (UDS) listeners and through faulty ACL matching logic. Because ATS commonly fronts internal origin servers and management endpoints, bypassing these IP allow/deny lists can expose protected backend resources that operators believed were network-restricted. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the fix is vendor-confirmed in the Apache advisory.
Denial-of-service (and potential memory-corruption) in Apache Traffic Server arises from mishandling of PROXY protocol input, where malformed port fields are truncated and cause a stack buffer overflow (CWE-121). Affected releases span the 8.x, 9.x, and 10.x branches (8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3), and remote attackers can crash the proxy when it is configured to accept PROXY protocol connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor scores the impact as availability-only (CVSS 4.0 base 8.2).
Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy silently truncates over-long HTTP header names, causing two distinct header names to alias to the same value. A network attacker can exploit this desynchronization to smuggle requests past the proxy and bypass security or routing policy. No public exploit has been identified at time of analysis, but the CVSS 9.3 rating and CWE-444 classification mark this as a high-priority proxy integrity flaw affecting a core CDN/caching component.
Out-of-bounds write and integer overflow in Apache Traffic Server's MIME and HTTP header parsing lets remote attackers corrupt memory by sending crafted headers to the proxy. It affects the 8.x, 9.x (through 9.2.14) and 10.x (through 10.1.3) branches, carries a high CVSS of 8.9 with a scope-change flag, and can lead to high integrity and availability impact. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the memory-corruption class makes it a strong patching priority.
Memory-exhaustion denial of service in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy drops its per-stream buffer cap while dechunking HTTP/2 or HTTP/3 responses. A remote, unauthenticated attacker acting as a deliberately slow client can force unbounded buffering and exhaust server memory, degrading or crashing the caching proxy. This is a pure availability issue (CWE-400) with no confidentiality or integrity impact; no public exploit has been identified at time of analysis.
Denial of service in Apache Traffic Server 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 lets remote unauthenticated attackers crash the proxy or exhaust its resources by sending abusive HTTP/2 framing and flow-control sequences. The flaw is availability-only (no data disclosure or code execution), carries a CVSS 4.0 base score of 8.7, and has no public exploit identified at time of analysis. The Apache HTTP Server project has released fixed builds (9.2.15 and 10.1.4).
HTTP request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) lets remote attackers desynchronize proxy/backend request parsing because the server fails to reject the Transfer-Encoding header on inbound HTTP/2 requests. When ATS downgrades those HTTP/2 requests to HTTP/1.1 for origin servers, the improper Transfer-Encoding directive creates a parsing discrepancy that enables downgrade request smuggling. No public exploit identified at time of analysis and it is not listed in CISA KEV, but this is a well-understood smuggling primitive tagged by the reporter for information disclosure.
Request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to desynchronize the proxy from backend origin servers by sending malformed chunked-transfer-encoded messages, per Apache advisory and NVD. Successful exploitation lets an attacker poison caches, bypass access controls, or disclose another client's information as tagged by the reporting source. No public exploit identified at time of analysis and the flaw is not in CISA KEV.
Denial-of-service (and potential memory corruption) in Apache Traffic Server affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3 when redirect following is enabled. The proxy copies the client-supplied Host header into a fixed-size stack buffer without bounds checking during redirect handling, so an over-long Host header overflows the stack and crashes the process. There is no public exploit identified at time of analysis, and the vendor-assessed impact is limited to availability (CVSS 4.0 base 8.2).
Improper input validation in Apache Traffic Server versions 9.2.0-9.2.14 and 10.1.0-10.1.3 lets remote attackers send malformed input that the proxy fails to validate, allowing manipulation of the integrity of downstream/backend traffic (e.g. request smuggling or response manipulation against systems behind the proxy). The CVSS 4.0 score is 7.7 (High), driven entirely by subsequent-system integrity impact (SI:H) with no confidentiality or availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Access control bypass in Apache Traffic Server versions 9.0.0 through 9.1.14 and 10.0.0 through 10.1.3 lets remote unauthenticated attackers subvert authorization enforcement at the proxy, tagged by Apache as an authentication bypass (CWE-284). Because Traffic Server acts as a caching/reverse proxy, the flaw's impact lands on backend systems it fronts rather than on the proxy process itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.0 (High).
Apache Traffic Server can be stalled by a crafted chunked HTTP transfer whose trailers ATS has been configured to strip: the proxy discards the trailer bytes but still waits for them, so the transaction hangs until the connection timeout expires. Versions 10.0.0 through 10.1.4 and 10.2.0 are exposed in their default configuration because proxy.config.http.drop_chunked_trailers is enabled by default in the 10.x line, while 8.1.11 and 9.2.5 through 9.2.15 are affected only where an operator has explicitly turned that setting on. Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, availability-only Low), this is a modest denial-of-service issue that degrades individual proxied connections rather than the whole service; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited.
HTTP request smuggling in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0) lets unauthenticated remote attackers send HEAD requests carrying Content-Length or Transfer-Encoding headers to desynchronize HTTP message framing between ATS and an upstream or downstream agent. The scope-changed CVSS 3.1 score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N) reflects high integrity impact - cache poisoning, request/response queue confusion, and possible access-control bypass - with limited confidentiality exposure; no public exploit code was identified at time of analysis. Vendor-released fixes are available in 9.2.16, 10.1.5, and 10.2.1.
HTTP request smuggling in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 allows attackers behind a front-end proxy that pools and reuses upstream connections to desynchronize responses and smuggle requests past that front end. The trigger is a client POST carrying 'Expect: 100-continue' when the origin responds before the request body is read, causing ATS to parse the unread body as the next request on the shared connection. Standalone ATS deployments, or those not fronted by a connection-reusing proxy, are not exploitable; no public exploit code or active exploitation was identified at time of analysis.
Request smuggling in Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 allows remote unauthenticated attackers to have a later request read as leftover body data on a recycled origin connection, enabling access-control bypass, cross-user request disruption, and cache poisoning. The attacker must declare a body via Content-Length or Expect: 100-continue but never fully send it, then win a timing window while ATS returns the origin connection to its shared keep-alive pool. No public exploit has been identified at time of analysis, but the default configuration is affected and exploitation is probabilistic rather than guaranteed.
HTTP/2 HPACK dynamic table desynchronization in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) exposes a premature-state-update flaw in header compression logic. An unauthenticated remote attacker can trigger an HPACK encode failure, leaving the server's encoder table out of sync with the peer decoder's table and corrupting all subsequent header blocks transmitted on that HTTP/2 connection. No public exploit has been identified at time of analysis; the AC:H rating indicates reliable triggering requires specific conditions, and CISA KEV does not list this vulnerability.
Buffer overrun in the Apache Traffic Server multiplexer plugin's chunk-decode logic allows network-adjacent attackers who can influence upstream origin responses to cause denial of service across versions 8.0.0 through 10.1.3. The flaw is classified as CWE-787 (Out-of-bounds Write) and is constrained to availability impact only - no code execution or data exposure is indicated. No public exploit or CISA KEV listing has been identified, and the CVSS 3.7 Low score reflects meaningful real-world limitations, primarily the high attack complexity imposed by the upstream-input dependency.
Out-of-bounds read in Apache Traffic Server's DNS answer parser (CWE-125) allows unauthenticated remote attackers - or adversaries capable of influencing DNS responses - to leak partial heap memory contents or crash the ATS process, affecting all three active release branches (8.x, 9.x, 10.x). The CVSS 6.5 Medium rating reflects no authentication barrier and no user interaction required, though impact is limited to partial confidentiality and availability loss with no integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis, but the network attack surface is broad given that every proxied request triggers DNS resolution.
Cross-connection information disclosure in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote unauthenticated attackers to receive data belonging to other clients because the proxy improperly reuses upstream server sessions and tunnels. Because the scope changes across trust boundaries, one client can be served another client's response data, making this a confidentiality-critical issue in a shared caching/proxy tier. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation is timing/condition dependent (CVSS AC:H).
Port-based access-control bypass in Apache Traffic Server stems from URL and userinfo mis-parsing that causes the proxy to evaluate ACL rules against an incorrect port value, allowing restricted backend ports to be reached. All three maintained release branches are affected - 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 - meaning the majority of deployed ATS instances are vulnerable. No public exploit or active exploitation has been identified at time of analysis, but the Changed scope (S:C) in the CVSS vector signals that successful exploitation crosses the proxy-to-backend boundary, amplifying real-world impact beyond the ATS process itself.
Improper TLS certificate validation in Apache Traffic Server (ATS) versions 9.0.0-9.2.14 and 10.0.0-10.1.3 allows multiplexed HTTP/2 origin connections to be reused for requests targeting hostnames not covered by the existing connection's server certificate. When ATS coalesces HTTP/2 connections to origin servers, it omits the check confirming the server certificate's Subject Alternative Names cover the new request's hostname, meaning traffic may be silently routed over a connection authenticated for a different host. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.2.15 and 10.1.4.
HTTP/2-to-HTTP/1 protocol conversion in Apache Traffic Server 10.0.0-10.1.3 forwards origin HTTP/2 trailers to downstream HTTP/1 clients without the required chunked transfer encoding framing, enabling HTTP response smuggling. The CVSS 8.3 Scope:Changed rating reflects that exploitation impacts downstream HTTP/1 clients architecturally separate from ATS itself, with potential for cache poisoning, response injection, and limited information disclosure. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Memory corruption in Apache Traffic Server during HPACK/XPACK header decoding exposes affected deployments to denial of service. Versions spanning the 8.x, 9.x, and 10.x release lines are affected, with unauthenticated remote attackers able to craft malformed compressed headers that trigger an integer overflow (CWE-190), corrupting server memory. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 5.9 Medium, reflecting that while no authentication is required, elevated attack complexity limits opportunistic mass exploitation; no public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
HTTP request smuggling in Apache Traffic Server allows unauthenticated remote attackers to interfere with how the proxy and backend servers interpret HTTP request boundaries, enabling cache poisoning and limited information disclosure. Versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 are confirmed affected per Apache advisory. The Scope Changed (S:C) CVSS metric reflects that exploitation crosses the proxy boundary to impact downstream backend systems. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unanchored regular expression matching in Apache Traffic Server exposes a high-severity bypass that allows remote unauthenticated attackers to circumvent regex-based access controls, potentially leaking protected content (C:H) and enabling limited unauthorized writes (I:L). All 9.0.x through 9.2.14 and 10.0.x through 10.1.3 deployments that rely on regex-driven rules for routing, ACL, or header policy enforcement are at risk. No public exploit code has been identified at time of analysis, and CISA has not listed this in KEV, but the low-complexity, unauthenticated network attack path makes it a realistic opportunistic target for any actor aware of the flaw.
Apache Traffic Server versions 9.0.0-9.2.12 and 10.0.0-10.1.1 are vulnerable to HTTP request smuggling through malformed chunked transfer encoding, allowing attackers to bypass security controls and smuggle malicious requests. The vulnerability stems from improper parsing of chunked messages (CWE-444: Inconsistent Interpretation of HTTP Requests) and affects all deployments using these versions as reverse proxies or intermediaries. Apache has released patched versions 9.2.13 and 10.1.2; no public exploit code or active exploitation has been reported at the time of analysis.
Denial of service in Apache Traffic Server 9.0.0-9.2.12 and 10.0.0-10.1.1 caused by improper handling of POST requests that triggers a server crash under specific conditions. The vulnerability affects all instances of the affected versions and requires no authentication or special privileges to exploit. Vendor-released patches are available in versions 9.2.13 and 10.1.2.