Vulnerabilities

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent head…

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.

The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses.

The Apache Traffic Server intercept plugin has a use-after-free.

The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching.

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input.

The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state.

The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input.

The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input.

The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input.

The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors.

Apache Traffic Server leaks memory when handling HostDB SRV records.

Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling.

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.

The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.

Apache Traffic Server reads out of bounds while parsing DNS answers.

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors.

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.

Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections.

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass.

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.