This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/trafficserver-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 241ce54 Update versions for security release
241ce54 is described below
commit 241ce54f692d8de237e00dd085f53747660232dc
Author: Chris McFarlen <[email protected]>
AuthorDate: Tue Jul 28 13:37:56 2026 -0500
Update versions for security release
---
content/security-2026-07.html | 449 +++++++++++++++++++++++++++++++
source/relativize_paths.py | 63 +++++
source/templates/downloads.template.html | 30 +--
source/templates/index.template.html | 71 +++--
source/versions.json | 16 +-
5 files changed, 586 insertions(+), 43 deletions(-)
diff --git a/content/security-2026-07.html b/content/security-2026-07.html
new file mode 100644
index 0000000..9634d4d
--- /dev/null
+++ b/content/security-2026-07.html
@@ -0,0 +1,449 @@
+<!DOCTYPE html>
+<!--
+============================================================
+APACHE TRAFFIC SERVER - SECURITY ADVISORY (July 2026)
+============================================================
+AUTO-GENERATED by Security/scripts/gen_advisory_page.py from cve-map.json.
+Do not edit this file directly; edit cve-map.json and regenerate.
+============================================================
+-->
+<html lang="en">
+<head>
+ <meta charset="UTF-8">
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
+ <title>Security Advisory - July 2026 CVE Release | Apache Traffic
Server</title>
+
+ <link rel="stylesheet" href="styles/tailwind-complete.css">
+ <link rel="stylesheet" href="styles/custom.css">
+ <style>
+ .adv-hero { background: linear-gradient(135deg, #1e3a8a 0%, #0e7490
100%); }
+ .adv-badge { display:inline-block; font-size:.7rem; font-weight:700;
letter-spacing:.06em;
+ text-transform:uppercase; padding:.2rem .6rem;
border-radius:9999px;
+ background:rgba(255,255,255,.15); color:#fff; border:1px solid
rgba(255,255,255,.3); }
+ .adv-stat { background:linear-gradient(135deg,rgba(255,255,255,.16)
0%,rgba(255,255,255,.05) 100%); border:1px solid rgba(255,255,255,.25);
+ border-radius:.75rem; padding:1rem 1.25rem; }
+ .adv-stat .n { font-size:1.75rem; font-weight:700; line-height:1; }
+ .adv-stat .n-versions { font-size:1.2rem; line-height:1.3; }
+ .adv-stat .l { font-size:.8rem; color:#dbeafe; margin-top:.25rem; }
+ .adv-note { background:#eff6ff; border:1px solid #bfdbfe;
border-left:4px solid #3b82f6;
+ border-radius:.5rem; padding:1rem 1.25rem; color:#1e3a8a; }
+ .adv-legend { font-size:.9rem; color:#475569; margin:0 0 1.75rem;
padding:.75rem 1rem;
+ background:#f8fafc; border:1px solid #e2e8f0; border-radius:.5rem;
line-height:1.6; }
+ .adv-legend strong { color:#1e293b; }
+ .type-dist { display:flex; flex-wrap:wrap; gap:.4rem;
align-items:center; margin:0 0 1.75rem; }
+ .type-dist .lbl { font-size:.9rem; color:#475569; font-weight:700;
margin-right:.15rem; }
+ .dist-chip { display:inline-block; font-size:.8rem; color:#334155;
background:#f1f5f9;
+ border:1px solid #cbd5e1; border-radius:9999px; padding:.2rem
.6rem; }
+ .dist-chip strong { color:#1e293b; }
+ .sev-head { display:flex; align-items:center; gap:.75rem;
margin:2.5rem 0 1rem; }
+ .sev-dot { width:.9rem; height:.9rem; border-radius:9999px; }
+ .sev-head h2 { font-size:1.5rem; font-weight:700; color:#1e3a8a;
margin:0; }
+ .sev-head .count { color:#64748b; font-weight:600; font-size:1rem; }
+ .cve-card { background:#fff; border:1px solid #e5e7eb; border-left:4px
solid #64748b;
+ border-radius:.75rem; padding:1.25rem 1.5rem; box-shadow:0 1px 2px
rgba(0,0,0,.05);
+ transition:box-shadow .2s ease, transform .2s ease; }
+ .cve-card:hover { box-shadow:0 8px 20px rgba(0,0,0,.08);
transform:translateY(-2px); }
+ .cve-top { display:flex; flex-wrap:wrap; align-items:center;
gap:.5rem; margin-bottom:.5rem; }
+ .cve-id { font-family:ui-monospace,SFMono-Regular,Menlo,monospace;
font-weight:700;
+ font-size:.95rem; color:#1e3a8a; }
+ .cve-id a { color:#1e3a8a; text-decoration:none; }
+ .cve-id a:hover { text-decoration:underline; }
+ .pending { font-family:inherit; font-weight:600; font-size:.72rem;
text-transform:uppercase;
+ letter-spacing:.05em; color:#92400e; background:#fef3c7;
border:1px solid #fde68a;
+ border-radius:9999px; padding:.15rem .55rem; }
+ .pill { font-size:.72rem; font-weight:700; text-transform:uppercase;
letter-spacing:.04em;
+ padding:.15rem .55rem; border-radius:9999px; }
+ .pill-important { color:#fff;
background:linear-gradient(135deg,#dc2626 0%,#991b1b 100%); border:none;
text-shadow:0 1px 1px rgba(0,0,0,.2); }
+ .pill-moderate { color:#78350f;
background:linear-gradient(135deg,#fde68a 0%,#fbbf24 100%); border:1px solid
#fcd34d; }
+ .pill-critical { color:#fff;
background:linear-gradient(135deg,#ef4444 0%,#7f1d1d 100%); border:none;
text-shadow:0 1px 1px rgba(0,0,0,.25); }
+ .pill-low { color:#fff;
background:linear-gradient(135deg,#94a3b8 0%,#475569 100%); border:none; }
+ .cvss { font-family:ui-monospace,SFMono-Regular,Menlo,monospace;
font-size:.72rem;
+ font-weight:600; color:#3730a3; background:#eef2ff; border:1px
solid #c7d2fe;
+ border-radius:9999px; padding:.15rem .55rem; }
+ .cve-title { font-size:1.05rem; font-weight:600; color:#111827;
margin:.15rem 0 .35rem; }
+ .cve-desc { color:#374151; line-height:1.6; margin:0 0 .75rem; }
+ .cve-meta { display:flex; flex-wrap:wrap; gap:.35rem 1.5rem; margin:0;
font-size:.85rem; }
+ .cve-meta div { display:flex; gap:.4rem; }
+ .cve-meta dt { color:#64748b; font-weight:600; margin:0; }
+ .cve-meta dd { color:#374151; margin:0; }
+ .cve-meta dd.type-dd { display:flex; flex-wrap:wrap; gap:.3rem; }
+ .type-tag { display:inline-block; font-size:.72rem; font-weight:600;
color:#334155;
+ background:#f1f5f9; border:1px solid #cbd5e1;
border-radius:9999px; padding:.05rem .55rem; }
+ </style>
+</head>
+<body class="font-sans text-gray-800 bg-white">
+ <header class="sticky top-0 z-50 bg-white shadow-sm">
+ <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8">
+ <div class="flex justify-between items-center py-4">
+ <div class="flex items-center">
+ <a href="index.html" class="flex items-center space-x-3">
+ <img src="images/press/ts_logo_tm_380x73.png"
alt="Apache Traffic Server" class="h-12 w-auto">
+ </a>
+ </div>
+
+ <nav class="hidden lg:flex items-center space-x-6">
+ <a href="index.html" class="text-gray-700
hover:text-accent transition-colors font-medium">Home</a>
+ <a href="downloads.html" class="text-gray-700
hover:text-accent transition-colors font-medium">Downloads</a>
+ <a
href="https://docs.trafficserver.apache.org/en/latest/index.html";
class="text-gray-700 hover:text-accent transition-colors
font-medium">Documentation</a>
+ <a href="https://github.com/apache/trafficserver";
class="text-gray-700 hover:text-accent transition-colors font-medium">GitHub</a>
+ <a href="https://github.com/apache/trafficserver/issues";
class="text-gray-700 hover:text-accent transition-colors font-medium">Issues</a>
+ <a href="https://ci.trafficserver.apache.org/";
class="text-gray-700 hover:text-accent transition-colors font-medium">CI</a>
+ <a href="users.html" class="text-gray-700
hover:text-accent transition-colors font-medium">Customers</a>
+ </nav>
+
+ <div class="hidden lg:flex items-center space-x-4">
+ <a href="https://www.apache.org/"; class="flex
items-center">
+ <img
src="https://www.apache.org/images/feather-small.png"; alt="The Apache Software
Foundation" class="h-10 w-auto">
+ </a>
+ </div>
+
+ <button id="mobile-menu-button" class="lg:hidden p-2
rounded-md text-gray-700 hover:text-accent hover:bg-gray-100 focus:outline-none
focus:ring-2 focus:ring-accent" aria-label="Toggle menu">
+ <svg class="h-6 w-6" fill="none" stroke="currentColor"
viewBox="0 0 24 24">
+ <path id="menu-icon" stroke-linecap="round"
stroke-linejoin="round" stroke-width="2" d="M4 6h16M4 12h16M4 18h16"/>
+ <path id="close-icon" class="hidden"
stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6
6l12 12"/>
+ </svg>
+ </button>
+ </div>
+
+ <nav id="mobile-menu" class="hidden lg:hidden pb-4
mobile-menu-enter">
+ <div class="space-y-2">
+ <a href="index.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Home</a>
+ <a href="downloads.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Downloads</a>
+ <a
href="https://docs.trafficserver.apache.org/en/latest/index.html"; class="block
px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent
transition-colors font-medium">Documentation</a>
+ <a href="https://github.com/apache/trafficserver";
class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100
hover:text-accent transition-colors font-medium">GitHub</a>
+ <a href="https://github.com/apache/trafficserver/issues";
class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100
hover:text-accent transition-colors font-medium">Issues</a>
+ <a href="https://ci.trafficserver.apache.org/";
class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100
hover:text-accent transition-colors font-medium">CI</a>
+ <a href="users.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Customers</a>
+ <a href="acknowledgements.html" class="block px-3 py-2
rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Acknowledgements</a>
+ <a href="press.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Press Kit</a>
+ </div>
+ </nav>
+ </div>
+ </header>
+
+ <section class="adv-hero text-white py-16">
+ <div class="max-w-5xl mx-auto px-4 sm:px-6 lg:px-8">
+ <span class="adv-badge">Security Release</span>
+ <h1 class="text-4xl md:text-5xl font-bold leading-tight mt-4 mb-4">
+ July 2026 CVE Release
+ </h1>
+ <p class="text-lg text-blue-100 mb-8 leading-relaxed max-w-3xl">
+ Apache Traffic Server <strong>9.2.14</strong> and
<strong>10.1.3</strong> fix the
+ 34 security vulnerabilities listed below. They affect all
releases up to and
+ including <strong>9.2.13</strong> and <strong>10.1.2</strong>
— among them
+ request-smuggling, memory-safety, and access-control issues,
the most serious
+ rated <strong>CVSS 10.0</strong>. Fixed releases are
available now,
+ and all users are strongly encouraged to upgrade promptly.
+ </p>
+ <div class="grid grid-cols-2 lg:grid-cols-4 gap-4 max-w-3xl">
+ <div class="adv-stat"><div class="n">34</div><div
class="l">Total CVEs</div></div>
+ <div class="adv-stat"><div class="n">9</div><div
class="l">Important</div></div>
+ <div class="adv-stat"><div class="n">25</div><div
class="l">Moderate</div></div>
+ <div class="adv-stat"><div class="n
n-versions">9.2.14<br>10.1.3</div><div class="l">Fixed versions</div></div>
+ </div>
+ <div class="mt-8">
+ <a href="downloads.html" class="btn-gradient inline-block px-6
py-3 rounded-lg font-semibold text-white">
+ Download the fixed releases
+ </a>
+ </div>
+ </div>
+ </section>
+
+ <section class="py-12 bg-white">
+ <div class="max-w-5xl mx-auto px-4 sm:px-6 lg:px-8">
+ <div class="adv-note" style="margin-bottom:2rem">
+ These vulnerabilities were identified through the Apache
Traffic Server security
+ process and an independent security audit of the code base. We
thank all reporters,
+ credited per advisory below. To report a security issue, email
+ <a href="mailto:[email protected]";
class="text-accent underline">[email protected]</a>;
+ please do not open public issues for security matters. See
also the
+ <a href="https://www.apache.org/security/"; class="text-accent
underline">ASF security policy</a>.
+ </div>
+ <div class="type-dist">
+ <span class="lbl">By type:</span>
+ <span class="dist-chip"><strong>15</strong> Memory
safety</span><span class="dist-chip"><strong>6</strong> Denial of
service</span><span class="dist-chip"><strong>6</strong> Request
smuggling</span><span class="dist-chip"><strong>4</strong> Access-control
bypass</span><span class="dist-chip"><strong>2</strong> SSRF</span><span
class="dist-chip"><strong>1</strong> Information disclosure</span><span
class="dist-chip"><strong>1</strong> Path traversal</span><span class="dist
[...]
+ </div>
+ <p class="adv-legend">
+ <strong>How to read this:</strong> <strong>Severity</strong>
is the Apache rating — the impact and exploitability of the issue in a
default configuration. <strong>CVSS</strong> is the technical base score, which
can be higher for issues that need specific conditions or a non-default
configuration to reach.
+ </p>
+ <div class="sev-head">
+ <span class="sev-dot" style="background:#dc2626"></span>
+ <h2>Important</h2>
+ <span class="count">9 advisories</span>
+ </div>
+ <div class="space-y-4">
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-33267"; target="_blank"
rel="noopener">CVE-2026-33267</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 10</span></div>
+ <h3 class="cve-title">Hop-by-hop and internal headers from
untrusted peers are not stripped</h3>
+ <p class="cve-desc">Apache Traffic Server does not strip
Connection-listed hop-by-hop or internal @ headers from untrusted peers before
plugin hooks, enabling request smuggling and metadata injection.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/1</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Charlie Campbell, Brian Neradt,
Apache Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58150"; target="_blank"
rel="noopener">CVE-2026-58150</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 10</span></div>
+ <h3 class="cve-title">HTTP/2 requests with
Transfer-Encoding are not rejected, allowing request smuggling</h3>
+ <p class="cve-desc">Apache Traffic Server does not reject
Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/2</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58155"; target="_blank"
rel="noopener">CVE-2026-58155</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 9.3</span></div>
+ <h3 class="cve-title">Header-name length truncation
enables header aliasing and request smuggling</h3>
+ <p class="cve-desc">Apache Traffic Server truncates
over-long header names, allowing header aliasing, request smuggling, and policy
bypass.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Header
parsing</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Request smuggling</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58154"; target="_blank"
rel="noopener">CVE-2026-58154</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 8.9</span></div>
+ <h3 class="cve-title">Memory-safety errors in MIME and
header parsing</h3>
+ <p class="cve-desc">Apache Traffic Server can write out of
bounds or overflow integers while parsing MIME and HTTP headers.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Header
parsing (MIME)</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Michael
Bommarito, Apache Community, Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58157"; target="_blank"
rel="noopener">CVE-2026-58157</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 8.7</span></div>
+ <h3 class="cve-title">Improper server-session reuse can
expose data across client connections</h3>
+ <p class="cve-desc">Apache Traffic Server can reuse server
sessions and tunnels improperly, exposing data across client connections.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP state
machine</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Information disclosure</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-22068"; target="_blank"
rel="noopener">CVE-2026-22068</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 8.2</span></div>
+ <h3 class="cve-title">Unanchored regular-expression
matching allows ACL and policy bypass</h3>
+ <p class="cve-desc">Apache Traffic Server uses unanchored
regular expressions for selection, so substring and suffix matches bypass ACL,
SNI, signature, and geo controls across remap and several plugins.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Remap /
SNI / plugins</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Access-control bypass</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58177"; target="_blank"
rel="noopener">CVE-2026-58177</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 8.1</span></div>
+ <h3 class="cve-title">Memory-safety and path-traversal
errors in the Cripts framework</h3>
+ <p class="cve-desc">The Apache Traffic Server Cripts
framework has out-of-bounds writes, path traversal, and use-after-free
errors.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>Cripts</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory safety</span><span
class="type-tag">Path traversal</span></dd></div><div><dt>Fixed
in</dt><dd>10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community,
Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58151"; target="_blank"
rel="noopener">CVE-2026-58151</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 7.5</span></div>
+ <h3 class="cve-title">Abusive HTTP/2 framing can exhaust
resources and crash the server</h3>
+ <p class="cve-desc">Apache Traffic Server can be crashed
or driven to resource exhaustion by abusive HTTP/2 framing and flow-control.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/2</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Denial of
service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#dc2626">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58161"; target="_blank"
rel="noopener">CVE-2026-58161</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 7.5</span></div>
+ <h3 class="cve-title">Memory-safety errors in TLS and SNI
handling can crash the server</h3>
+ <p class="cve-desc">Apache Traffic Server can crash from
null dereferences and dangling references in TLS and SNI handling.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>TLS/SNI</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ </div>
+ <div class="sev-head">
+ <span class="sev-dot" style="background:#d97706"></span>
+ <h2>Moderate</h2>
+ <span class="count">25 advisories</span>
+ </div>
+ <div class="space-y-4">
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-57834"; target="_blank"
rel="noopener">CVE-2026-57834</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 10</span></div>
+ <h3 class="cve-title">Malformed chunked message body
allows request smuggling</h3>
+ <p class="cve-desc">Apache Traffic Server allows request
smuggling if chunked messages are malformed.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/1</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Haruki Oyama, Katsutoshi Ikenoya
(LY Corporation), Apache Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58162"; target="_blank"
rel="noopener">CVE-2026-58162</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 10</span></div>
+ <h3 class="cve-title">Certifier plugin trusts client SNI
when generating certificates</h3>
+ <p class="cve-desc">The Apache Traffic Server certifier
plugin generates certificates based on attacker-controlled client SNI.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
certifier</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Spoofing / cert trust</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-41920"; target="_blank"
rel="noopener">CVE-2026-41920</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 9.3</span></div>
+ <h3 class="cve-title">SNI and Host comparison uses a
one-sided length, allowing host-SNI policy bypass</h3>
+ <p class="cve-desc">Apache Traffic Server compares the TLS
SNI against the Host header with a length taken from the Host alone, so any SNI
that has the Host as a prefix bypasses host-SNI policy.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>TLS/SNI</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Access-control
bypass</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>JD Marsters (Bhut Red), Apache
Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58182"; target="_blank"
rel="noopener">CVE-2026-58182</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.6</span></div>
+ <h3 class="cve-title">ts_lua plugin has initialization and
resource-handling errors</h3>
+ <p class="cve-desc">The Apache Traffic Server ts_lua
plugin mishandles initialization, transform context, and per-instance state.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
ts_lua</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58153"; target="_blank"
rel="noopener">CVE-2026-58153</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.3</span></div>
+ <h3 class="cve-title">HTTP/2 and HTTP/3 to HTTP/1
conversion can leak framing and trailers to clients</h3>
+ <p class="cve-desc">Apache Traffic Server can lose
per-stream framing and forward origin trailers when converting HTTP/2 or HTTP/3
to HTTP/1, enabling smuggling.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP/2 ·
HTTP/3 → HTTP/1</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Request smuggling</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58159"; target="_blank"
rel="noopener">CVE-2026-58159</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.2</span></div>
+ <h3 class="cve-title">Listener and ACL handling allow
access-control bypass</h3>
+ <p class="cve-desc">Apache Traffic Server can bypass IP
access controls on UDS listeners and through ACL matching errors.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>Remap/ACL</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Access-control
bypass</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58184"; target="_blank"
rel="noopener">CVE-2026-58184</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.2</span></div>
+ <h3 class="cve-title">header_rewrite plugin cookie
handling can corrupt memory</h3>
+ <p class="cve-desc">The Apache Traffic Server
header_rewrite plugin can crash or corrupt memory during cookie operations.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
header_rewrite</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58188"; target="_blank"
rel="noopener">CVE-2026-58188</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.2</span></div>
+ <h3 class="cve-title">Memory-safety and limit-bypass
errors across experimental plugins</h3>
+ <p class="cve-desc">Several Apache Traffic Server
experimental plugins have memory-safety and limit-bypass errors.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugins
(experimental)</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Yon Harlicaj,
Apache Community, Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58179"; target="_blank"
rel="noopener">CVE-2026-58179</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.1</span></div>
+ <h3 class="cve-title">regex_remap plugin overflows the
stack from attacker input</h3>
+ <p class="cve-desc">The Apache Traffic Server regex_remap
plugin overflows the stack and integers from substitution input.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
regex_remap</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58163"; target="_blank"
rel="noopener">CVE-2026-58163</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
+ <h3 class="cve-title">Cache deserialization and lifetime
errors can corrupt state or crash the server</h3>
+ <p class="cve-desc">Apache Traffic Server mishandles
on-disk cache fields and object lifetimes, corrupting state or crashing.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>Cache</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58164"; target="_blank"
rel="noopener">CVE-2026-58164</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
+ <h3 class="cve-title">Remap configuration lifetime and
TOCTOU errors cause use-after-free</h3>
+ <p class="cve-desc">Apache Traffic Server has
use-after-free and time-of-check/time-of-use errors in remap configuration
handling.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Remap
config</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58175"; target="_blank"
rel="noopener">CVE-2026-58175</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
+ <h3 class="cve-title">HostDB SRV handling leaks memory</h3>
+ <p class="cve-desc">Apache Traffic Server leaks memory
when handling HostDB SRV records.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HostDB</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Denial of
service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58178"; target="_blank"
rel="noopener">CVE-2026-58178</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
+ <h3 class="cve-title">ESI plugin allows uncontrolled
recursion and server-side request forgery</h3>
+ <p class="cve-desc">The Apache Traffic Server ESI plugin
can recurse without bound and fetch attacker-controlled URLs.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
ESI</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">SSRF</span><span class="type-tag">Denial of
service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58180"; target="_blank"
rel="noopener">CVE-2026-58180</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
+ <h3 class="cve-title">txn_box plugin overflows the stack
from attacker input</h3>
+ <p class="cve-desc">The Apache Traffic Server txn_box
plugin overflows the stack from attacker-controlled input.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
txn_box</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58181"; target="_blank"
rel="noopener">CVE-2026-58181</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
+ <h3 class="cve-title">uri_signing and url_sig plugins can
exhaust the stack or crash</h3>
+ <p class="cve-desc">The Apache Traffic Server uri_signing
and url_sig plugins can exhaust the stack or crash on attacker input.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
uri_signing / url_sig</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Denial of service</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58186"; target="_blank"
rel="noopener">CVE-2026-58186</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
+ <h3 class="cve-title">webp_transform plugin decodes
unsafely and mislabels degraded responses</h3>
+ <p class="cve-desc">The Apache Traffic Server
webp_transform plugin can decode unsafely and serve mislabeled, cacheable
responses.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
webp_transform</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58189"; target="_blank"
rel="noopener">CVE-2026-58189</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
+ <h3 class="cve-title">Plugins resetting the redirect
counter enable SSRF amplification</h3>
+ <p class="cve-desc">Apache Traffic Server allows
redirect-limit bypass when plugins reset the retry counter, enabling SSRF
amplification.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP state
machine</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">SSRF</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-24033"; target="_blank"
rel="noopener">CVE-2026-24033</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.2</span></div>
+ <h3 class="cve-title">Chunked extension quoted-string
parsing allows request smuggling</h3>
+ <p class="cve-desc">Apache Traffic Server terminates a
chunked-extension quoted-string at CRLF, so a smuggled request hidden in the
quoted value is parsed as a second request when ATS is a reverse proxy.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/1</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Rajat Raghav, Katsutoshi Ikenoya
(LY Corporation)</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58160"; target="_blank"
rel="noopener">CVE-2026-58160</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 6.5</span></div>
+ <h3 class="cve-title">Out-of-bounds reads while parsing
DNS responses</h3>
+ <p class="cve-desc">Apache Traffic Server reads out of
bounds while parsing DNS answers.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>DNS</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58152"; target="_blank"
rel="noopener">CVE-2026-58152</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 5.9</span></div>
+ <h3 class="cve-title">Integer-handling errors in
HPACK/XPACK decoding corrupt memory</h3>
+ <p class="cve-desc">Apache Traffic Server mishandles
integers while decoding HPACK/XPACK headers, corrupting memory.</p>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HPACK/XPACK</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.14 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58158"; target="_blank"
rel="noopener">CVE-2026-58158</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 5.9</span></div>
+ <h3 class="cve-title">PROXY protocol parsing has port
truncation and a stack overflow</h3>
+ <p class="cve-desc">Apache Traffic Server mishandles PROXY
protocol input, truncating ports and overflowing the stack.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>PROXY
protocol</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58183"; target="_blank"
rel="noopener">CVE-2026-58183</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 5.9</span></div>
+ <h3 class="cve-title">prefetch plugin can crash on
attacker-influenced input</h3>
+ <p class="cve-desc">The Apache Traffic Server prefetch
plugin can crash when processing attacker-influenced input.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
prefetch</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Denial of service</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58185"; target="_blank"
rel="noopener">CVE-2026-58185</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 5.9</span></div>
+ <h3 class="cve-title">Use-after-free in the intercept
plugin</h3>
+ <p class="cve-desc">The Apache Traffic Server intercept
plugin has a use-after-free.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
intercept</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58156"; target="_blank"
rel="noopener">CVE-2026-58156</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 4.9</span></div>
+ <h3 class="cve-title">URL and port parsing errors allow
access-control bypass</h3>
+ <p class="cve-desc">Apache Traffic Server mis-parses ports
in URLs and userinfo, allowing port-based access-control bypass.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>URL
parsing</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Access-control bypass</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
+ </article>
+ <article class="cve-card" style="border-left-color:#d97706">
+ <div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58187"; target="_blank"
rel="noopener">CVE-2026-58187</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 3.7</span></div>
+ <h3 class="cve-title">Multiplexer plugin chunk decoder
enables a denial of service</h3>
+ <p class="cve-desc">The Apache Traffic Server multiplexer
plugin overruns its chunk-decode buffer on upstream input, enabling denial of
service.</p>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
multiplexer</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Denial of service</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.14 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ </article>
+ </div>
+ </div>
+ </section>
+ <footer class="bg-gray-50 border-t border-gray-200 mt-16">
+ <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-12">
+ <div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-4 gap-8">
+ <div>
+ <h3 class="text-sm font-semibold text-gray-900 uppercase
tracking-wider mb-4">Resources</h3>
+ <ul class="space-y-3">
+ <li><a
href="https://docs.trafficserver.apache.org/en/latest/index.html";
class="text-secondary hover:text-accent
transition-colors">Documentation</a></li>
+ <li><a href="https://github.com/apache/trafficserver/";
class="text-secondary hover:text-accent transition-colors">Source Code</a></li>
+ <li><a href="via.html" class="text-secondary
hover:text-accent transition-colors">Via Header Decoder</a></li>
+ </ul>
+ </div>
+
+ <div>
+ <h3 class="text-sm font-semibold text-gray-900 uppercase
tracking-wider mb-4">Community</h3>
+ <ul class="space-y-3">
+ <li><a href="users.html" class="text-secondary
hover:text-accent transition-colors">Customers</a></li>
+ <li><a
href="https://github.com/apache/trafficserver/issues"; class="text-secondary
hover:text-accent transition-colors">Issues</a></li>
+ <li><a href="https://infra.apache.org/slack.html";
class="text-secondary hover:text-accent transition-colors">Slack
(#traffic-server)</a></li>
+ </ul>
+ </div>
+
+ <div>
+ <h3 class="text-sm font-semibold text-gray-900 uppercase
tracking-wider mb-4">Apache</h3>
+ <ul class="space-y-3">
+ <li><a href="https://www.apache.org/";
class="text-secondary hover:text-accent transition-colors">Foundation</a></li>
+ <li><a href="https://www.apache.org/licenses/";
class="text-secondary hover:text-accent transition-colors">License</a></li>
+ <li><a href="https://www.apache.org/security/";
class="text-secondary hover:text-accent transition-colors">Security</a></li>
+ <li><a
href="https://privacy.apache.org/policies/privacy-policy-public.html";
class="text-secondary hover:text-accent transition-colors">Privacy</a></li>
+ <li><a
href="https://www.apache.org/events/current-event.html"; class="text-secondary
hover:text-accent transition-colors">Events</a></li>
+ <li><a
href="https://www.apache.org/foundation/sponsorship.html"; class="text-secondary
hover:text-accent transition-colors">Donate</a></li>
+ <li><a
href="https://www.apache.org/foundation/thanks.html"; class="text-secondary
hover:text-accent transition-colors">Thanks</a></li>
+ </ul>
+ </div>
+
+ <div>
+ <h3 class="text-sm font-semibold text-gray-900 uppercase
tracking-wider mb-4">More</h3>
+ <ul class="space-y-3">
+ <li><a href="press.html" class="text-secondary
hover:text-accent transition-colors">Press Kit</a></li>
+ <li><a href="acknowledgements.html"
class="text-secondary hover:text-accent
transition-colors">Acknowledgements</a></li>
+ </ul>
+ </div>
+ </div>
+
+ <div class="mt-12 pt-8 border-t border-gray-200 flex flex-col
md:flex-row justify-between items-center">
+ <p class="text-secondary text-sm text-center md:text-left">
+ Copyright © 2026 <a href="https://www.apache.org/";
class="hover:text-accent">The Apache Software Foundation</a>.
+ Licensed under the <a
href="https://www.apache.org/licenses/"; class="hover:text-accent">Apache
License</a>, Version 2.0.
+ Apache Traffic Server, Apache, the Apache Traffic Server
logo, and the Apache feather logo are trademarks of The Apache Software
Foundation.
+ </p>
+ <div class="mt-4 md:mt-0">
+ <a href="https://www.apache.org/"; class="inline-block">
+ <img
src="https://www.apache.org/images/feather-small.png"; alt="Apache" class="h-8
w-auto">
+ </a>
+ </div>
+ </div>
+ </div>
+ </footer>
+
+ <script src="js/menu.js"></script>
+</body>
+</html>
diff --git a/source/relativize_paths.py b/source/relativize_paths.py
new file mode 100755
index 0000000..86b8b47
--- /dev/null
+++ b/source/relativize_paths.py
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""
+relativize_paths.py - convert absolute root paths (href="/x", src="/x") to
+relative ones on the site's root-level (depth-0) pages.
+
+Why: the ATS site is served from the domain root, so "/styles/x.css" and
+"styles/x.css" resolve to the identical URL in production. But "/styles/x.css"
+breaks when a page is opened directly with a file:// URL (the leading slash
+points at the filesystem root). Making the paths relative works in BOTH the
+file:// preview and when served at the domain root.
+
+Only run this on files that live at the content root (depth 0). All current
+site pages that reference assets are depth 0; logbuilder has none.
+
+USAGE
+ ./source/relativize_paths.py content/*.html source/templates/*.html
+
+Idempotent: files with no absolute refs are left unchanged.
+Stdlib-only.
+"""
+from __future__ import annotations
+
+import re
+import sys
+
+# href="/" -> href="index.html" (bare home link; file:// has no dir index)
+HOME = re.compile(r'href="/"')
+# (href|src)="/path" -> (href|src)="path" (strip one leading slash;
+# the negative lookahead leaves protocol-relative //host untouched).
+ROOT = re.compile(r'\b(href|src)="/(?!/)')
+
+
+def relativize(html: str) -> str:
+ html = HOME.sub('href="index.html"', html)
+ html = ROOT.sub(r'\1="', html)
+ return html
+
+
+def main(argv: list[str]) -> int:
+ if not argv:
+ print(__doc__)
+ return 2
+ changed = 0
+ for path in argv:
+ with open(path) as f:
+ src = f.read()
+ out = relativize(src)
+ if out != src:
+ with open(path, "w") as f:
+ f.write(out)
+ changed += 1
+ print(f"relativized: {path}")
+ else:
+ print(f"unchanged: {path}")
+ print(f"\n{changed} file(s) changed")
+ return 0
+
+
+if __name__ == "__main__":
+ try:
+ raise SystemExit(main(sys.argv[1:]))
+ except KeyboardInterrupt:
+ raise SystemExit(130)
diff --git a/source/templates/downloads.template.html
b/source/templates/downloads.template.html
index 8f40a67..82388da 100644
--- a/source/templates/downloads.template.html
+++ b/source/templates/downloads.template.html
@@ -29,10 +29,10 @@ To update versions:
See the License for the specific language governing permissions and
limitations under the License. -->
<!-- Tailwind CSS -->
- <link rel="stylesheet" href="/styles/tailwind-complete.css">
+ <link rel="stylesheet" href="styles/tailwind-complete.css">
<!-- Custom Styles -->
- <link rel="stylesheet" href="/styles/custom.css">
+ <link rel="stylesheet" href="styles/custom.css">
</head>
<body class="font-sans text-gray-800 bg-white">
<!-- Header -->
@@ -40,19 +40,19 @@ To update versions:
<div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8">
<div class="flex justify-between items-center py-4">
<div class="flex items-center">
- <a href="/" class="flex items-center space-x-3">
- <img src="/images/press/ts_logo_tm_380x73.png"
alt="Apache Traffic Server" class="h-12 w-auto">
+ <a href="index.html" class="flex items-center space-x-3">
+ <img src="images/press/ts_logo_tm_380x73.png"
alt="Apache Traffic Server" class="h-12 w-auto">
</a>
</div>
<nav class="hidden lg:flex items-center space-x-6">
- <a href="/" class="text-gray-700 hover:text-accent
transition-colors font-medium">Home</a>
- <a href="/downloads.html" class="text-accent
font-semibold">Downloads</a>
+ <a href="index.html" class="text-gray-700
hover:text-accent transition-colors font-medium">Home</a>
+ <a href="downloads.html" class="text-accent
font-semibold">Downloads</a>
<a
href="https://docs.trafficserver.apache.org/en/latest/index.html";
class="text-gray-700 hover:text-accent transition-colors
font-medium">Documentation</a>
<a href="https://github.com/apache/trafficserver";
class="text-gray-700 hover:text-accent transition-colors font-medium">GitHub</a>
<a href="https://github.com/apache/trafficserver/issues";
class="text-gray-700 hover:text-accent transition-colors font-medium">Issues</a>
<a href="https://ci.trafficserver.apache.org/";
class="text-gray-700 hover:text-accent transition-colors font-medium">CI</a>
- <a href="/users.html" class="text-gray-700
hover:text-accent transition-colors font-medium">Customers</a>
+ <a href="users.html" class="text-gray-700
hover:text-accent transition-colors font-medium">Customers</a>
</nav>
<div class="hidden lg:flex items-center space-x-4">
@@ -71,13 +71,13 @@ To update versions:
<nav id="mobile-menu" class="hidden lg:hidden pb-4">
<div class="space-y-2">
- <a href="/" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Home</a>
- <a href="/downloads.html" class="block px-3 py-2
rounded-md bg-blue-50 text-accent font-semibold">Downloads</a>
+ <a href="index.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Home</a>
+ <a href="downloads.html" class="block px-3 py-2 rounded-md
bg-blue-50 text-accent font-semibold">Downloads</a>
<a
href="https://docs.trafficserver.apache.org/en/latest/index.html"; class="block
px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent
transition-colors font-medium">Documentation</a>
<a href="https://github.com/apache/trafficserver";
class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100
hover:text-accent transition-colors font-medium">GitHub</a>
<a href="https://github.com/apache/trafficserver/issues";
class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100
hover:text-accent transition-colors font-medium">Issues</a>
<a href="https://ci.trafficserver.apache.org/";
class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100
hover:text-accent transition-colors font-medium">CI</a>
- <a href="/users.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Customers</a>
+ <a href="users.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Customers</a>
</div>
</nav>
</div>
@@ -262,14 +262,14 @@ To update versions:
<ul class="space-y-3">
<li><a
href="https://docs.trafficserver.apache.org/en/latest/index.html";
class="text-secondary hover:text-accent
transition-colors">Documentation</a></li>
<li><a href="https://github.com/apache/trafficserver/";
class="text-secondary hover:text-accent transition-colors">Source Code</a></li>
- <li><a href="/via.html" class="text-secondary
hover:text-accent transition-colors">Via Header Decoder</a></li>
+ <li><a href="via.html" class="text-secondary
hover:text-accent transition-colors">Via Header Decoder</a></li>
</ul>
</div>
<div>
<h3 class="text-sm font-semibold text-gray-900 uppercase
tracking-wider mb-4">Community</h3>
<ul class="space-y-3">
- <li><a href="/users.html" class="text-secondary
hover:text-accent transition-colors">Customers</a></li>
+ <li><a href="users.html" class="text-secondary
hover:text-accent transition-colors">Customers</a></li>
<li><a
href="https://github.com/apache/trafficserver/issues"; class="text-secondary
hover:text-accent transition-colors">Issues</a></li>
<li><a href="https://infra.apache.org/slack.html";
class="text-secondary hover:text-accent transition-colors">Slack
(#traffic-server)</a></li>
</ul>
@@ -291,8 +291,8 @@ To update versions:
<div>
<h3 class="text-sm font-semibold text-gray-900 uppercase
tracking-wider mb-4">More</h3>
<ul class="space-y-3">
- <li><a href="/press.html" class="text-secondary
hover:text-accent transition-colors">Press Kit</a></li>
- <li><a href="/acknowledgements.html"
class="text-secondary hover:text-accent
transition-colors">Acknowledgements</a></li>
+ <li><a href="press.html" class="text-secondary
hover:text-accent transition-colors">Press Kit</a></li>
+ <li><a href="acknowledgements.html"
class="text-secondary hover:text-accent
transition-colors">Acknowledgements</a></li>
</ul>
</div>
</div>
@@ -313,7 +313,7 @@ To update versions:
</footer>
<!-- Mobile Menu Script -->
- <script src="/js/menu.js"></script>
+ <script src="js/menu.js"></script>
</body>
</html>
diff --git a/source/templates/index.template.html
b/source/templates/index.template.html
index 7f98fc6..97ab57a 100644
--- a/source/templates/index.template.html
+++ b/source/templates/index.template.html
@@ -18,27 +18,34 @@ To update:
<meta name="google-site-verification"
content="0Zvqk8EoyLzvCzEZj86bw4McxpCrEzUskO2c1n5OqE8">
<title>Apache Traffic Server</title>
- <link rel="stylesheet" href="/styles/tailwind-complete.css">
- <link rel="stylesheet" href="/styles/custom.css">
+ <link rel="stylesheet" href="styles/tailwind-complete.css">
+ <link rel="stylesheet" href="styles/custom.css">
+ <style>
+ @keyframes atsPulse { 0%,100% { opacity:1; transform:scale(1); } 50% {
opacity:.5; transform:scale(1.15); } }
+ .ats-alert-icon { animation: atsPulse 1.8s ease-in-out infinite; }
+ .ats-alert-cta { transition: transform .2s ease, box-shadow .2s ease; }
+ .ats-alert-cta:hover { transform: translateY(-1px); box-shadow: 0 6px
18px rgba(0,0,0,.28); }
+ @media (prefers-reduced-motion: reduce) { .ats-alert-icon { animation:
none; } }
+ </style>
</head>
<body class="font-sans text-gray-800 bg-white">
<header class="sticky top-0 z-50 bg-white shadow-sm">
<div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8">
<div class="flex justify-between items-center py-4">
<div class="flex items-center">
- <a href="/" class="flex items-center space-x-3">
- <img src="/images/press/ts_logo_tm_380x73.png"
alt="Apache Traffic Server" class="h-12 w-auto">
+ <a href="index.html" class="flex items-center space-x-3">
+ <img src="images/press/ts_logo_tm_380x73.png"
alt="Apache Traffic Server" class="h-12 w-auto">
</a>
</div>
<nav class="hidden lg:flex items-center space-x-6">
- <a href="/" class="text-gray-700 hover:text-accent
transition-colors font-medium">Home</a>
- <a href="/downloads.html" class="text-gray-700
hover:text-accent transition-colors font-medium">Downloads</a>
+ <a href="index.html" class="text-gray-700
hover:text-accent transition-colors font-medium">Home</a>
+ <a href="downloads.html" class="text-gray-700
hover:text-accent transition-colors font-medium">Downloads</a>
<a
href="https://docs.trafficserver.apache.org/en/latest/index.html";
class="text-gray-700 hover:text-accent transition-colors
font-medium">Documentation</a>
<a href="https://github.com/apache/trafficserver";
class="text-gray-700 hover:text-accent transition-colors font-medium">GitHub</a>
<a href="https://github.com/apache/trafficserver/issues";
class="text-gray-700 hover:text-accent transition-colors font-medium">Issues</a>
<a href="https://ci.trafficserver.apache.org/";
class="text-gray-700 hover:text-accent transition-colors font-medium">CI</a>
- <a href="/users.html" class="text-gray-700
hover:text-accent transition-colors font-medium">Customers</a>
+ <a href="users.html" class="text-gray-700
hover:text-accent transition-colors font-medium">Customers</a>
</nav>
<div class="hidden lg:flex items-center space-x-4">
@@ -57,20 +64,42 @@ To update:
<nav id="mobile-menu" class="hidden lg:hidden pb-4
mobile-menu-enter">
<div class="space-y-2">
- <a href="/" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Home</a>
- <a href="/downloads.html" class="block px-3 py-2
rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Downloads</a>
+ <a href="index.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Home</a>
+ <a href="downloads.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Downloads</a>
<a
href="https://docs.trafficserver.apache.org/en/latest/index.html"; class="block
px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent
transition-colors font-medium">Documentation</a>
<a href="https://github.com/apache/trafficserver";
class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100
hover:text-accent transition-colors font-medium">GitHub</a>
<a href="https://github.com/apache/trafficserver/issues";
class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100
hover:text-accent transition-colors font-medium">Issues</a>
<a href="https://ci.trafficserver.apache.org/";
class="block px-3 py-2 rounded-md text-gray-700 hover:bg-gray-100
hover:text-accent transition-colors font-medium">CI</a>
- <a href="/users.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Customers</a>
- <a href="/acknowledgements.html" class="block px-3 py-2
rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Acknowledgements</a>
- <a href="/press.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Press Kit</a>
+ <a href="users.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Customers</a>
+ <a href="acknowledgements.html" class="block px-3 py-2
rounded-md text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Acknowledgements</a>
+ <a href="press.html" class="block px-3 py-2 rounded-md
text-gray-700 hover:bg-gray-100 hover:text-accent transition-colors
font-medium">Press Kit</a>
</div>
</nav>
</div>
</header>
+ <!-- ============================================================ -->
+ <!-- HOT TOPIC BANNER - current security release -->
+ <!-- Update the text/link here when the featured topic changes. -->
+ <!-- ============================================================ -->
+ <a href="security-2026-07.html" class="block"
style="background:linear-gradient(135deg,#d97706 0%,#b45309
100%);border-top:3px solid #78350f;box-shadow:0 4px 16px
rgba(180,83,9,.4);text-decoration:none;" aria-label="July 2026 CVE release
security advisory">
+ <div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8"
style="padding-top:.9rem;padding-bottom:.9rem;">
+ <div class="flex flex-col sm:flex-row items-center justify-between
gap-4">
+ <div class="flex items-center gap-4">
+ <svg class="h-8 w-8 flex-shrink-0 ats-alert-icon"
style="color:#fff" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+ <path stroke-linecap="round" stroke-linejoin="round"
stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955
11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622
5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"/>
+ </svg>
+ <span class="flex-shrink-0"
style="display:inline-block;background:#1e3a8a;color:#fff;font-size:.85rem;font-weight:800;letter-spacing:.1em;padding:.4rem
.9rem;border-radius:9999px;white-space:nowrap;box-shadow:0 1px 3px
rgba(0,0,0,.25);">SECURITY RELEASE</span>
+ <div style="color:#fff;line-height:1.35;text-shadow:0 1px
2px rgba(0,0,0,.28);">
+ <div
style="font-size:1.2rem;font-weight:700;letter-spacing:.01em;">July 2026 CVE
Release</div>
+ <div
style="font-size:1.02rem;opacity:.95;"><strong>34</strong> vulnerabilities
fixed in Apache Traffic Server 9.2.14 & 10.1.3. Upgrading is strongly
recommended.</div>
+ </div>
+ </div>
+ <span class="ats-alert-cta"
style="display:inline-block;background:#fff;color:#b45309;font-weight:700;font-size:.98rem;letter-spacing:.01em;padding:.65rem
1.35rem;border-radius:.5rem;white-space:nowrap;box-shadow:0 3px 12px
rgba(0,0,0,.2);">Read the advisory →</span>
+ </div>
+ </div>
+ </a>
+
<section class="relative bg-gradient-to-br from-blue-900 via-blue-800
to-cyan-700 text-white py-20">
<div class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8">
<div class="grid grid-cols-1 lg:grid-cols-2 gap-12 items-center">
@@ -85,7 +114,7 @@ To update:
Powering major CDNs and content providers worldwide,
serving multiple terabits per second of traffic.
</p>
<div class="flex flex-col sm:flex-row gap-4">
- <a href="/downloads.html" class="btn-gradient
inline-block px-8 py-4 rounded-lg font-semibold text-white text-lg text-center">
+ <a href="downloads.html" class="btn-gradient
inline-block px-8 py-4 rounded-lg font-semibold text-white text-lg text-center">
Download Now
</a>
<a
href="https://docs.trafficserver.apache.org/en/latest/index.html";
class="inline-block px-8 py-4 rounded-lg font-semibold bg-white/10
hover:bg-white/20 backdrop-blur-sm text-white text-lg text-center
transition-all border border-white/20">
@@ -178,7 +207,7 @@ To update:
</div>
<h3 class="text-xl font-semibold text-primary
mb-4">Proven</h3>
<p class="text-gray-600 leading-relaxed">
- Battle-tested at scale, powering multiple terabits per
second of traffic at major CDNs and content providers worldwide. Visit our <a
href="/users.html" class="text-accent underline">Customers page</a> for more
users.
+ Battle-tested at scale, powering multiple terabits per
second of traffic at major CDNs and content providers worldwide. Visit our <a
href="users.html" class="text-accent underline">Customers page</a> for more
users.
</p>
</div>
@@ -286,7 +315,7 @@ To update:
<path fill-rule="evenodd" d="M10 18a8 8 0
100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1
0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z" clip-rule="evenodd"/>
</svg>
<div>
- <p class="text-gray-600">Use the <a
href="/via.html" class="text-accent underline">Via Header Decoder</a> to parse
and debug ATS Via headers.</p>
+ <p class="text-gray-600">Use the <a
href="via.html" class="text-accent underline">Via Header Decoder</a> to parse
and debug ATS Via headers.</p>
</div>
</li>
</ul>
@@ -306,7 +335,7 @@ To update:
</div>
<div class="mt-8 text-center">
- <a href="/downloads.html" class="inline-block px-6 py-3
bg-gray-100 hover:bg-gray-200 text-gray-800 rounded-lg font-medium
transition-colors">
+ <a href="downloads.html" class="inline-block px-6 py-3
bg-gray-100 hover:bg-gray-200 text-gray-800 rounded-lg font-medium
transition-colors">
View All Releases
</a>
</div>
@@ -322,14 +351,14 @@ To update:
<ul class="space-y-3">
<li><a
href="https://docs.trafficserver.apache.org/en/latest/index.html";
class="text-secondary hover:text-accent
transition-colors">Documentation</a></li>
<li><a href="https://github.com/apache/trafficserver/";
class="text-secondary hover:text-accent transition-colors">Source Code</a></li>
- <li><a href="/via.html" class="text-secondary
hover:text-accent transition-colors">Via Header Decoder</a></li>
+ <li><a href="via.html" class="text-secondary
hover:text-accent transition-colors">Via Header Decoder</a></li>
</ul>
</div>
<div>
<h3 class="text-sm font-semibold text-gray-900 uppercase
tracking-wider mb-4">Community</h3>
<ul class="space-y-3">
- <li><a href="/users.html" class="text-secondary
hover:text-accent transition-colors">Customers</a></li>
+ <li><a href="users.html" class="text-secondary
hover:text-accent transition-colors">Customers</a></li>
<li><a
href="https://github.com/apache/trafficserver/issues"; class="text-secondary
hover:text-accent transition-colors">Issues</a></li>
<li><a href="https://infra.apache.org/slack.html";
class="text-secondary hover:text-accent transition-colors">Slack
(#traffic-server)</a></li>
</ul>
@@ -351,8 +380,8 @@ To update:
<div>
<h3 class="text-sm font-semibold text-gray-900 uppercase
tracking-wider mb-4">More</h3>
<ul class="space-y-3">
- <li><a href="/press.html" class="text-secondary
hover:text-accent transition-colors">Press Kit</a></li>
- <li><a href="/acknowledgements.html"
class="text-secondary hover:text-accent
transition-colors">Acknowledgements</a></li>
+ <li><a href="press.html" class="text-secondary
hover:text-accent transition-colors">Press Kit</a></li>
+ <li><a href="acknowledgements.html"
class="text-secondary hover:text-accent
transition-colors">Acknowledgements</a></li>
</ul>
</div>
</div>
@@ -372,7 +401,7 @@ To update:
</div>
</footer>
- <script src="/js/menu.js"></script>
+ <script src="js/menu.js"></script>
</body>
</html>
diff --git a/source/versions.json b/source/versions.json
index 4ce51c8..8d6de32 100644
--- a/source/versions.json
+++ b/source/versions.json
@@ -1,24 +1,27 @@
{
"versions": {
"v10": {
- "version": "10.1.3",
- "date": "July 16, 2026",
+ "version": "10.1.4",
+ "date": "July 28, 2026",
"branch": "10.1.x",
- "description": "Bugfix and stability release for the 10.1 stable
release",
+ "description": "Bugfix, security and stability release for the 10.1
stable release",
"label": "Latest Stable",
"label_color": "green"
},
"v9": {
- "version": "9.2.14",
- "date": "July 16, 2026",
+ "version": "9.2.15",
+ "date": "July 28, 2026",
"branch": "9.2.x",
"description": "Long-term support with security fixes and critical
updates",
"label": "LTS",
"label_color": "blue"
}
},
-
"news": [
+ {
+ "date": "July 28, 2026",
+ "text": "<strong>Upcoming:</strong> Apache Traffic Server
<strong>v9.2.15</strong> and <strong>v10.1.4</strong> security releases
addressing 34 CVEs. Read the <a href=\"security-2026-07.html\"
class=\"text-accent underline\">July 2026 CVE release advisory</a>."
+ },
{
"date": "July 16, 2026",
"text": "We are releasing version <strong>v9.2.14</strong> and
<strong>v10.1.3</strong> which include security fixes and improvements. We
recommend everyone to upgrade to one of these versions of ATS."
@@ -65,4 +68,3 @@
}
]
}
-
![https://www.apache.org/images/feather-small.png"](https://www.apache.org/images/feather-small.png"){kind=link}