CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,479 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,479
Show in the list
Critical, last 7 days
360
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product apache:traffic_server. Show all products

42 CVEs, showing 1 to 42
CVESeverityTitlePublished
CVE-2023-44487
Known exploited
High 7.5The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Assigned by mitre
Oct 10, 2023
CVE-2025-58136High 7.5A bug in POST request handling causes a crash under a certain condition.Apr 2, 2026
CVE-2025-65114High 7.5Apache Traffic Server allows request smuggling if chunked messages are malformed.Apr 2, 2026
CVE-2026-59173High 7.5Uncontrolled Resource Consumption vulnerability in Apache Traffic Server.Jul 18, 2026
CVE-2026-41920Critical 9.3Apache Traffic Server: SNI to Host header matching policy is not properly enforced
Assigned by apache
Jul 29, 2026
CVE-2026-22068High 8.2Apache Traffic Server: Regex mappings match with malicious domain names
Assigned by apache
Jul 29, 2026
CVE-2026-33267Critical 10.0Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata
Assigned by apache
Jul 29, 2026
CVE-2026-24033High 7.2Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing
Assigned by apache
Jul 29, 2026
CVE-2026-33930Medium 5.9Apache Traffic Server: Buffer overflow via Host field that has a long string value
Assigned by apache
Jul 29, 2026
CVE-2026-57834Critical 10.0Apache Traffic Server: Malformed chunked message body allows request smuggling
Assigned by apache
Jul 29, 2026
CVE-2026-58150Critical 10.0Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
Assigned by apache
Jul 29, 2026
CVE-2026-58151High 7.5Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server
Assigned by apache
Jul 29, 2026
CVE-2026-58152Medium 5.9Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory
Assigned by apache
Jul 29, 2026
CVE-2026-58153High 8.3Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely
Assigned by apache
Jul 29, 2026
CVE-2026-65324High 7.5Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion
Assigned by apache
Jul 29, 2026
CVE-2026-65325Medium 4.8Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification
Assigned by apache
Jul 29, 2026
CVE-2026-58154High 8.9Apache Traffic Server: Memory-safety errors in MIME and header parsing
Assigned by apache
Jul 29, 2026
CVE-2026-58155Critical 9.3Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling
Assigned by apache
Jul 29, 2026
CVE-2026-58156Medium 4.9Apache Traffic Server: URL and port parsing errors allow access-control bypass
Assigned by apache
Jul 29, 2026
CVE-2026-58157High 8.7Apache Traffic Server: Improper server-session reuse can expose data across client connections
Assigned by apache
Jul 29, 2026
CVE-2026-58158Medium 5.9Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow
Assigned by apache
Jul 29, 2026
CVE-2026-58159High 8.2Apache Traffic Server: Listener and ACL handling allow access-control bypass
Assigned by apache
Jul 29, 2026
CVE-2026-58160Medium 6.5Apache Traffic Server: Out-of-bounds reads while parsing DNS responses
Assigned by apache
Jul 29, 2026
CVE-2026-58161High 7.5Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server
Assigned by apache
Jul 29, 2026
CVE-2026-58162Critical 10.0Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates
Assigned by apache
Jul 29, 2026
CVE-2026-58163High 7.5Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server
Assigned by apache
Jul 29, 2026
CVE-2026-58164High 7.5Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free
Assigned by apache
Jul 29, 2026
CVE-2026-58175High 7.5Apache Traffic Server: HostDB SRV handling leaks memory
Assigned by apache
Jul 29, 2026
CVE-2026-58177High 8.1Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework
Assigned by apache
Jul 29, 2026
CVE-2026-58178High 7.5Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery
Assigned by apache
Jul 29, 2026
CVE-2026-58179High 8.1Apache Traffic Server: regex_remap plugin overflows the stack from attacker input
Assigned by apache
Jul 29, 2026
CVE-2026-58180High 7.5Apache Traffic Server: txn_box plugin overflows the stack from attacker input
Assigned by apache
Jul 29, 2026
CVE-2026-58181High 7.5Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash
Assigned by apache
Jul 29, 2026
CVE-2026-58182High 8.6Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors
Assigned by apache
Jul 29, 2026
CVE-2026-58183Medium 5.9Apache Traffic Server: prefetch plugin can crash on attacker-influenced input
Assigned by apache
Jul 29, 2026
CVE-2026-58184High 8.2Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory
Assigned by apache
Jul 29, 2026
CVE-2026-58185Medium 5.9Apache Traffic Server: Use-after-free in the intercept plugin
Assigned by apache
Jul 29, 2026
CVE-2026-58186High 7.5Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses
Assigned by apache
Jul 29, 2026
CVE-2026-58187Low 3.7Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service
Assigned by apache
Jul 29, 2026
CVE-2026-58188High 8.2Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins
Assigned by apache
Jul 29, 2026
CVE-2026-58189High 7.5Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification
Assigned by apache
Jul 29, 2026
CVE-2026-65100Medium 4.8Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode
Assigned by apache
Jul 29, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.