Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Apache Traffic Server — Vulnerabilities & Security Advisories 103

All 103 CVE vulnerabilities found in Apache Traffic Server, with AI-generated Chinese analysis, references, and POCs.

This page provides a comprehensive aggregation of known security vulnerabilities affecting Apache Traffic Server, categorizing them by common weakness type and associated tags. It collects a wide variety of vulnerability records, including but not limited to buffer overflows, improper input validation, and information disclosure flaws, covering all publicly disclosed issues within the specified historical time range. By accessing this resource, users can efficiently track vendor advisories from the Apache Software Foundation, gain a deeper understanding of specific weakness classes and their impact on web caching infrastructure, and review the complete vulnerability history of the product to assess long-term security posture. The data is organized to facilitate quick reference for security analysts, system administrators, and developers who need to evaluate the risk profile of their deployment environments. This collection serves as a centralized repository for detecting patterns in bug fixes and identifying recurring security themes within the codebase. Maintaining awareness of these historical issues is critical for applying appropriate patches and configuring secure settings to mitigate potential threats. The information presented here is derived from official vulnerability databases and vendor releases, ensuring accuracy and reliability for decision-making purposes.

Vendor: Apache Software Foundation

CVE ID Title CVSS Severity Published
CVE-2026-58152 Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory CWE-190 5.9 Medium 2026-07-29
CVE-2026-58151 Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server CWE-400 7.5 High 2026-07-29
CVE-2026-58150 Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling CWE-444 10.0 Critical 2026-07-29
CVE-2026-57834 Apache Traffic Server: Malformed chunked message body allows request smuggling CWE-444 10.0 Critical 2026-07-29
CVE-2026-33930 Apache Traffic Server: Buffer overflow via Host field that has a long string value CWE-121 5.9 Medium 2026-07-29
CVE-2026-24033 Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing CWE-444 7.2 High 2026-07-29
CVE-2026-33267 Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata CWE-20 10.0 Critical 2026-07-29
CVE-2026-22068 Apache Traffic Server: Regex mappings match with malicious domain names CWE-777 8.2 High 2026-07-29
CVE-2026-41920 Apache Traffic Server: SNI to Host header matching policy is not properly enforced CWE-284 9.3 Critical 2026-07-29
CVE-2026-59173 Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions CWE-400 - - 2026-07-18
CVE-2025-65114 Apache Traffic Server: Malformed chunked message body allows request smuggling CWE-444 7.5AI High AI 2026-04-02
CVE-2025-58136 Apache Traffic Server: A simple legitimate POST request causes a crash CWE-670 7.5AI High AI 2026-04-02
CVE-2025-31698 Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL CWE-284 - - AI 2025-06-19
CVE-2025-49763 Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin CWE-400 7.5AI High AI 2025-06-19
CVE-2024-53868 Apache Traffic Server: Malformed chunked message body allows request smuggling CWE-444 7.5AI High AI 2025-04-03
CVE-2024-38311 Apache Traffic Server: Request smuggling via pipelining after a chunked message body CWE-20 7.5 - 2025-03-06
CVE-2024-56195 Apache Traffic Server: Intercept plugins are not access controlled CWE-284 - - 2025-03-06
CVE-2024-56196 Apache Traffic Server: ACL is not fully compatible with older versions CWE-284 - - 2025-03-06
CVE-2024-56202 Apache Traffic Server: Expect header field can unreasonably retain resource CWE-440 9.1 - 2025-03-06
CVE-2024-50306 Apache Traffic Server: Server process can fail to drop privilege CWE-252 9.8 - 2024-11-14
CVE-2024-50305 Apache Traffic Server: Valid Host field value can cause crashes CWE-20 6.5 - 2024-11-14
CVE-2024-38479 Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack CWE-20 9.1 - 2024-11-14
CVE-2023-38522 Apache Traffic Server: Incomplete field name check allows request smuggling CWE-444 5.3 - 2024-07-26
CVE-2024-35296 Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests CWE-20 5.3 - 2024-07-26
CVE-2024-35161 Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling CWE-444 5.3 - 2024-07-26
CVE-2024-31309 Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack CWE-20 7.5 - 2024-04-10
CVE-2023-39456 Apache Traffic Server: Malformed http/2 frames can cause an abort CWE-20 7.5 - 2023-10-17
CVE-2023-41752 Apache Traffic Server: s3_auth plugin problem with hash calculation CWE-200 7.5 - 2023-10-17
CVE-2023-33934 Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies CWE-444 8.2 - 2023-08-09
CVE-2022-47185 Apache Traffic Server: Invalid Range header causes a crash CWE-20 8.2 - 2023-08-09

All 103 known CVE vulnerabilities affecting Apache Traffic Server with full Chinese analysis, references, and POCs where available.