Apache Traffic Server vulnerabilities

Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. Affected versions are from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4.

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying that the server certificate covers the new request hostname. This affects versions from 9.0.0 through 9.2.14 and from 10.0.0 through 10.1.3.

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.

Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. Affects versions from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3.

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. Affected versions are from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4.

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. Affects versions 10.0.0 through 10.1.3.

Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. Affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. Affected versions are from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4.

Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, causing a stack overflow when redirect following is enabled. Affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3.

HTTP Request Smuggling vulnerability in Apache Traffic Server. Affects versions 10.0.0 through 10.1.3 and 9.0.0 through 9.2.14.

A Regular Expression without Anchors vulnerability was found in Apache Traffic Server. It affects versions from 10.0.X through 10.1.3 and from 9.0.X through 9.2.14. Upgrading to version 9.2.15 or 10.1.4 fixes the issue.

Uncontrolled resource consumption vulnerability in Apache Traffic Server. Affects versions from 9.0.0 through 9.1.13 and from 10.0.0 through 10.1.2.

A vulnerability in Apache Traffic Server (versions 9.0.0 through 9.2.12 and 10.0.0 through 10.1.1) allows request smuggling if chunked messages are malformed.

A bug in POST request handling causes a crash under a certain condition in Apache Traffic Server versions 10.0.0 through 10.1.1 and 9.0.0 through 9.2.12. The issue is fixed in versions 10.1.2 and 9.2.13. A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0.

A vulnerability in Apache Traffic Server allows unauthorized exposure of sensitive information. This affects versions from 8.0.0 through 9.2.0.