CVE-2016-5396

Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.

Unspecified vulnerability in Apache Traffic Server versions 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1. This vulnerability may be related to health checks, but its impact and attack vectors are unknown.

The certifier plugin in Apache Traffic Server generates certificates based on attacker-controlled client SNI. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.

Apache Traffic Server is vulnerable to request smuggling when chunked messages are malformed. This affects versions from 8.0.0 to 8.1.9, from 9.0.0 to 9.2.14, and from 10.0.0 to 10.1.3.

Apache Traffic Server has an Improper Access Control vulnerability. This affects versions from 9.0.0 to 9.1.14 and from 10.0.0 to 10.1.3.

Apache Traffic Server has an Improper Input Validation vulnerability. This affects versions from 9.2.0 to 9.2.14 and from 10.1.0 to 10.1.3.

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server through version 9.2.1.

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the frame_handlers array or set_dynamic_table_size function.