Apache Traffic Server vulnerabilities

Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.

Apache Traffic Server versions 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.

Unspecified vulnerability in Apache Traffic Server versions 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1. This vulnerability may be related to health checks, but its impact and attack vectors are unknown.

The certifier plugin in Apache Traffic Server generates certificates based on attacker-controlled client SNI. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.

Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. Affects versions 8.0.0-8.1.9, 9.0.0-9.2.14, 10.0.0-10.1.3.

Apache Traffic Server is vulnerable to request smuggling when chunked messages are malformed. This affects versions from 8.0.0 to 8.1.9, from 9.0.0 to 9.2.14, and from 10.0.0 to 10.1.3.

Apache Traffic Server has an Improper Access Control vulnerability. This affects versions from 9.0.0 to 9.1.14 and from 10.0.0 to 10.1.3.

Apache Traffic Server has an Improper Input Validation vulnerability. This affects versions from 9.2.0 to 9.2.14 and from 10.1.0 to 10.1.3.

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server through version 9.2.1.

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the frame_handlers array or set_dynamic_table_size function.

Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT.

An unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before version 5.3.2 may lead to unknown impact and attack vectors.

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This affects versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. Affects versions from 8.0.0 through 10.1.3.

Several experimental plugins in Apache Traffic Server have memory-safety and limit-bypass errors. Affects versions from 8.0.0 through 10.1.3.

A vulnerability in the Apache Traffic Server multiplexer plugin causes a chunk-decode buffer overrun on upstream input, enabling denial of service. Affects versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3; fixed in versions 9.2.15 and 10.1.4.

The webp_transform plugin of Apache Traffic Server can unsafely decode WebP images and serve mislabeled, cacheable responses. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

The Apache Traffic Server intercept plugin has a use-after-free vulnerability. This affects versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.

The header_rewrite plugin of Apache Traffic Server can crash or corrupt memory during cookie operations and CIDR condition matching. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This affects versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.

The ts_lua plugin of Apache Traffic Server mishandles initialization, transform context, and per-instance state. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

The uri_signing and url_sig plugins of Apache Traffic Server can exhaust the stack or crash on attacker input. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

The txn_box plugin of Apache Traffic Server overflows the stack from attacker-controlled input. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

The regex_remap plugin of Apache Traffic Server overflows the stack and integers from substitution input. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

The ESI plugin of Apache Traffic Server can recurse without bound and fetch attacker-controlled URLs. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

The Cripts framework of Apache Traffic Server has out-of-bounds writes, path traversal, and use-after-free errors. Affected versions: 10.0.0 through 10.1.3.

Apache Traffic Server leaks memory when handling HostDB SRV records. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Apache Traffic Server has use-after-free and time-of-check/time-of-use (TOCTOU) errors in remap configuration handling. Affected versions: 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. Affects versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. Affects versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Apache Traffic Server reads out of bounds while parsing DNS answers. This affects versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.

Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. Affects versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This affects versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.

Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. Affects versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying that the server certificate covers the new request hostname. This affects versions from 9.0.0 through 9.2.14 and from 10.0.0 through 10.1.3.

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. Affects versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This affects versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. Affects versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. Affects versions 10.0.0 through 10.1.3.

Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This affects versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. Affects versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without bounds checking during redirect handling, causing a stack overflow when redirect following is enabled. This affects versions from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.

HTTP Request Smuggling vulnerability in Apache Traffic Server. Affects versions 10.0.0 through 10.1.3 and 9.0.0 through 9.2.14.

A Regular Expression without Anchors vulnerability was found in Apache Traffic Server. It affects versions from 10.0.X through 10.1.3 and from 9.0.X through 9.2.14. Upgrading to version 9.2.15 or 10.1.4 fixes the issue.

Uncontrolled resource consumption vulnerability in Apache Traffic Server. Affects versions from 9.0.0 through 9.1.13 and from 10.0.0 through 10.1.2.

A vulnerability in Apache Traffic Server (versions 9.0.0 through 9.2.12 and 10.0.0 through 10.1.1) allows request smuggling if chunked messages are malformed.

A bug in POST request handling causes a crash under a certain condition in Apache Traffic Server versions 10.0.0 through 10.1.1 and 9.0.0 through 9.2.12. The issue is fixed in versions 10.1.2 and 9.2.13. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0.

A vulnerability in Apache Traffic Server allows unauthorized exposure of sensitive information. This affects versions from 8.0.0 through 9.2.0.