CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,501 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,501
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product apache:traffic_server. Show all products

42 CVEs, showing 1 to 42
CVESeverityTitlePublished
CVE-2026-65100Medium 4.8Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and cor…Jul 29, 2026
CVE-2026-58189High 7.5Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.Jul 29, 2026
CVE-2026-58188High 8.2Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.Jul 29, 2026
CVE-2026-58187High 7.5The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.Jul 29, 2026
CVE-2026-58186High 7.5The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses.Jul 29, 2026
CVE-2026-58185Critical 9.8The Apache Traffic Server intercept plugin has a use-after-free.Jul 29, 2026
CVE-2026-58184High 7.5The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching.Jul 29, 2026
CVE-2026-58183High 7.5The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input.Jul 29, 2026
CVE-2026-58182High 8.6The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state.Jul 29, 2026
CVE-2026-58181High 7.5The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input.Jul 29, 2026
CVE-2026-58180High 7.5The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input.Jul 29, 2026
CVE-2026-58179Critical 9.8The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input.Jul 29, 2026
CVE-2026-58178High 7.5The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.Jul 29, 2026
CVE-2026-58177Critical 9.8The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors.Jul 29, 2026
CVE-2026-58175High 7.5Apache Traffic Server leaks memory when handling HostDB SRV records.Jul 29, 2026
CVE-2026-58164High 7.5Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling.Jul 29, 2026
CVE-2026-58163Critical 9.1Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.Jul 29, 2026
CVE-2026-58162Critical 10.0The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.Jul 29, 2026
CVE-2026-58161High 7.5Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.Jul 29, 2026
CVE-2026-58160Medium 6.5Apache Traffic Server reads out of bounds while parsing DNS answers.Jul 29, 2026
CVE-2026-58159High 8.2Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors.Jul 29, 2026
CVE-2026-58158Medium 5.9Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.Jul 29, 2026
CVE-2026-58157High 8.7Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections.Jul 29, 2026
CVE-2026-65325Medium 4.8Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname.Jul 29, 2026
CVE-2026-65324High 7.5Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory.Jul 29, 2026
CVE-2026-58156Medium 4.9Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass.Jul 29, 2026
CVE-2026-58155Critical 9.3Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.Jul 29, 2026
CVE-2026-58154High 8.9Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers.Jul 29, 2026
CVE-2026-58153High 8.3Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1.Jul 29, 2026
CVE-2026-58152Medium 5.9Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory.Jul 29, 2026
CVE-2026-58151High 7.5Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control.Jul 29, 2026
CVE-2026-58150Critical 10.0Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling.Jul 29, 2026
CVE-2026-57834Critical 10.0Apache Traffic Server allows request smuggling if chunked messages are malformed.Jul 29, 2026
CVE-2026-41920Critical 9.3Improper Access Control vulnerability in Apache Traffic Server.Jul 29, 2026
CVE-2026-33930Medium 5.9Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the stack when redirect following is…Jul 29, 2026
CVE-2026-33267Critical 9.1Improper Input Validation vulnerability in Apache Traffic Server.Jul 29, 2026
CVE-2026-24033Medium 5.3Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server.Jul 29, 2026
CVE-2026-22068Medium 5.3Regular Expression without Anchors vulnerability in Apache Traffic Server.Jul 29, 2026
CVE-2026-59173High 7.5Uncontrolled Resource Consumption vulnerability in Apache Traffic Server.Jul 18, 2026
CVE-2025-65114High 7.5Apache Traffic Server allows request smuggling if chunked messages are malformed.Apr 2, 2026
CVE-2025-58136High 7.5A bug in POST request handling causes a crash under a certain condition.Apr 2, 2026
CVE-2023-44487
Known exploited
High 7.5The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Assigned by mitre
Oct 10, 2023

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.