Apache

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service.

Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2.

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service.

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors rela…

Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT.

Unchecked return value can allow Apache Traffic Server to retain privileges on startup.

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding.

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing.

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory.

Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server.

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers.

Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.

Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5206.

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.