Apache Software Foundation Apache Traffic Server

• CVE-2026-24033 High 7.2 Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing 0.6%
• CVE-2026-33267 Critical 10.0 Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata 0.6%
• CVE-2026-22068 High 8.2 Apache Traffic Server: Regex mappings match with malicious domain names 0.6%
• CVE-2026-41920 Critical 9.3 Apache Traffic Server: SNI to Host header matching policy is not properly enforced 0.5%
• CVE-2026-59173 High 7.5 Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions 0.7%
• CVE-2025-65114 High 7.5 Apache Traffic Server: Malformed chunked message body allows request smuggling 0.4%
• CVE-2025-58136 High 7.5 Apache Traffic Server: A simple legitimate POST request causes a crash 0.7%
• CVE-2025-31698 High 7.5 Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL 0.6%
• CVE-2025-49763 High 7.5 Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin 0.7%
• CVE-2024-53868 High 7.5 Apache Traffic Server: Malformed chunked message body allows request smuggling 0.7%
• CVE-2024-38311 Medium 6.3 Apache Traffic Server: Request smuggling via pipelining after a chunked message body 0.9%
• CVE-2024-56195 Medium 6.3 Apache Traffic Server: Intercept plugins are not access controlled 0.8%
• CVE-2024-56196 Medium 6.3 Apache Traffic Server: ACL is not fully compatible with older versions 0.8%
• CVE-2024-56202 Medium 4.3 Apache Traffic Server: Expect header field can unreasonably retain resource 0.9%
• CVE-2024-50306 Critical 9.1 Apache Traffic Server: Server process can fail to drop privilege 1.6%
• CVE-2024-50305 High 7.5 Apache Traffic Server: Valid Host field value can cause crashes 0.9%
• CVE-2024-38479 High 7.5 Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack 0.8%
• CVE-2023-38522 High 7.5 Apache Traffic Server: Incomplete field name check allows request smuggling 1.0%
• CVE-2024-35296 High 8.2 Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests 1.1%
• CVE-2024-35161 Critical 9.1 Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling 1.0%
• CVE-2024-31309 High 7.5 Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack 94.6%
• CVE-2023-39456 High 7.5 Apache Traffic Server: Malformed http/2 frames can cause an abort 58.3%
• CVE-2023-41752 High 7.5 Apache Traffic Server: s3_auth plugin problem with hash calculation 1.6%
• CVE-2023-33934 Critical 9.1 Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies 1.6%
• CVE-2022-47185 High 7.5 Apache Traffic Server: Invalid Range header causes a crash 2.0%
• CVE-2023-30631 Unrated Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work 2.0%
• CVE-2023-33933 High 7.5 Apache Traffic Server: s3_auth plugin problem with hash calculation 1.5%
• CVE-2022-47184 High 7.5 Apache Traffic Server: The TRACE method can be use to disclose network information 1.5%
• CVE-2022-40743 Medium 6.1 Apache Traffic Server: Security issues with the xdebug plugin 1.1%
• CVE-2022-37392 Medium 5.3 Apache Traffic Server: Improperly reading the client requests 1.2%
• CVE-2022-32749 High 7.5 Apache Traffic Server: Improperly handled requests can cause crashes in specific plugins 1.4%
• CVE-2022-31779 Unrated Improper HTTP/2 scheme and method validation 2.5%
• CVE-2022-25763 Medium 6.8 Improper input validation on HTTP/2 headers 2.1%
• CVE-2021-37150 Medium 4.2 Protocol vs scheme mismatch 2.3%
• CVE-2022-28129 Unrated Insufficient Validation of HTTP/1.x Headers 2.5%
• CVE-2022-31778 Unrated Transfer-Encoding not treated as hop-by-hop 2.1%
• CVE-2022-31780 Unrated HTTP/2 framing vulnerabilities 2.5%
• CVE-2021-44759 Unrated Improper authentication vulnerability in TLS origin verification 1.6%
• CVE-2021-44040 Unrated HTTP request line fuzzing attacks 2.0%
• CVE-2021-43082 Unrated heap-buffer-overflow with stats-over-http plugin 2.4%
• CVE-2021-41585 Unrated ATS stops accepting connections on FreeBSD 2.5%
• CVE-2021-38161 Unrated Not validating origin TLS certificate 1.9%
• CVE-2021-37149 Unrated Request Smuggling - multiple attacks 2.7%
• CVE-2021-37148 Unrated Request Smuggling - transfer encoding validation 2.7%
• CVE-2021-37147 Unrated Request Smuggling - LF line ending 2.5%
• CVE-2021-35474 Unrated Dynamic stack buffer overflow in cachekey plugin 2.7%
• CVE-2021-32567 Unrated Reading HTTP/2 frames too many times 2.4%
• CVE-2021-32566 Unrated Specific sequence of HTTP/2 frames can cause ATS to crash 2.4%
• CVE-2021-32565 Unrated HTTP Request Smuggling, content length with invalid charters 2.1%
• CVE-2021-27577 Unrated Incorrect handling of url fragment leads to cache poisoning 3.4%