This is an automated email from the ASF dual-hosted git repository.
cmcfarlen pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/trafficserver-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new 56b2004 Fix versions for security release
56b2004 is described below
commit 56b20049945f104f5ce8e4de663bb320c6abf0e8
Author: Chris McFarlen <[email protected]>
AuthorDate: Tue Jul 28 14:49:32 2026 -0500
Fix versions for security release
---
content/security-2026-07.html | 68 +++++++++++++++++++++----------------------
1 file changed, 34 insertions(+), 34 deletions(-)
diff --git a/content/security-2026-07.html b/content/security-2026-07.html
index e668ea6..d1d3239 100644
--- a/content/security-2026-07.html
+++ b/content/security-2026-07.html
@@ -176,55 +176,55 @@ Do not edit this file directly; edit cve-map.json and
regenerate.
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-33267"; target="_blank"
rel="noopener">CVE-2026-33267</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 10</span></div>
<h3 class="cve-title">Hop-by-hop and internal headers from
untrusted peers are not stripped</h3>
<p class="cve-desc">Apache Traffic Server does not strip
Connection-listed hop-by-hop or internal @ headers from untrusted peers before
plugin hooks, enabling request smuggling and metadata injection.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/1</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Charlie Campbell, Brian Neradt,
Apache Community</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/1</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Charlie Campbell, Brian Neradt,
Apache Community</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#dc2626">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58150"; target="_blank"
rel="noopener">CVE-2026-58150</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 10</span></div>
<h3 class="cve-title">HTTP/2 requests with
Transfer-Encoding are not rejected, allowing request smuggling</h3>
<p class="cve-desc">Apache Traffic Server does not reject
Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/2</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/2</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#dc2626">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58155"; target="_blank"
rel="noopener">CVE-2026-58155</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 9.3</span></div>
<h3 class="cve-title">Header-name length truncation
enables header aliasing and request smuggling</h3>
<p class="cve-desc">Apache Traffic Server truncates
over-long header names, allowing header aliasing, request smuggling, and policy
bypass.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Header
parsing</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Request smuggling</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Header
parsing</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Request smuggling</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#dc2626">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58154"; target="_blank"
rel="noopener">CVE-2026-58154</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 8.9</span></div>
<h3 class="cve-title">Memory-safety errors in MIME and
header parsing</h3>
<p class="cve-desc">Apache Traffic Server can write out of
bounds or overflow integers while parsing MIME and HTTP headers.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Header
parsing (MIME)</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Michael
Bommarito, Apache Community, Omkhar Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Header
parsing (MIME)</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Michael
Bommarito, Apache Community, Omkhar Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#dc2626">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58157"; target="_blank"
rel="noopener">CVE-2026-58157</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 8.7</span></div>
<h3 class="cve-title">Improper server-session reuse can
expose data across client connections</h3>
<p class="cve-desc">Apache Traffic Server can reuse server
sessions and tunnels improperly, exposing data across client connections.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP state
machine</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Information disclosure</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP state
machine</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Information disclosure</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#dc2626">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-22068"; target="_blank"
rel="noopener">CVE-2026-22068</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 8.2</span></div>
<h3 class="cve-title">Unanchored regular-expression
matching allows ACL and policy bypass</h3>
<p class="cve-desc">Apache Traffic Server uses unanchored
regular expressions for selection, so substring and suffix matches bypass ACL,
SNI, signature, and geo controls across remap and several plugins.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Remap /
SNI / plugins</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Access-control bypass</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Remap /
SNI / plugins</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Access-control bypass</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#dc2626">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58177"; target="_blank"
rel="noopener">CVE-2026-58177</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 8.1</span></div>
<h3 class="cve-title">Memory-safety and path-traversal
errors in the Cripts framework</h3>
<p class="cve-desc">The Apache Traffic Server Cripts
framework has out-of-bounds writes, path traversal, and use-after-free
errors.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>Cripts</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory safety</span><span
class="type-tag">Path traversal</span></dd></div><div><dt>Fixed
in</dt><dd>10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community,
Omkhar Arasaratnam</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>Cripts</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory safety</span><span
class="type-tag">Path traversal</span></dd></div><div><dt>Fixed
in</dt><dd>10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache Community,
Omkhar Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#dc2626">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58151"; target="_blank"
rel="noopener">CVE-2026-58151</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 7.5</span></div>
<h3 class="cve-title">Abusive HTTP/2 framing can exhaust
resources and crash the server</h3>
<p class="cve-desc">Apache Traffic Server can be crashed
or driven to resource exhaustion by abusive HTTP/2 framing and flow-control.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/2</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Denial of
service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/2</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Denial of
service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#dc2626">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58161"; target="_blank"
rel="noopener">CVE-2026-58161</a></span><span class="pill
pill-important">Important</span><span class="cvss">CVSS 7.5</span></div>
<h3 class="cve-title">Memory-safety errors in TLS and SNI
handling can crash the server</h3>
<p class="cve-desc">Apache Traffic Server can crash from
null dereferences and dangling references in TLS and SNI handling.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>TLS/SNI</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar Arasaratnam</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>TLS/SNI</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar Arasaratnam</dd></div></dl>
</article>
</div>
<div class="sev-head">
@@ -237,151 +237,151 @@ Do not edit this file directly; edit cve-map.json and
regenerate.
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-57834"; target="_blank"
rel="noopener">CVE-2026-57834</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 10</span></div>
<h3 class="cve-title">Malformed chunked message body
allows request smuggling</h3>
<p class="cve-desc">Apache Traffic Server allows request
smuggling if chunked messages are malformed.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/1</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Haruki Oyama, Katsutoshi Ikenoya
(LY Corporation), Apache Community</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/1</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Haruki Oyama, Katsutoshi Ikenoya
(LY Corporation), Apache Community</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58162"; target="_blank"
rel="noopener">CVE-2026-58162</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 10</span></div>
<h3 class="cve-title">Certifier plugin trusts client SNI
when generating certificates</h3>
<p class="cve-desc">The Apache Traffic Server certifier
plugin generates certificates based on attacker-controlled client SNI.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
certifier</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Spoofing / cert trust</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
certifier</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Spoofing / cert trust</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-41920"; target="_blank"
rel="noopener">CVE-2026-41920</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 9.3</span></div>
<h3 class="cve-title">SNI and Host comparison uses a
one-sided length, allowing host-SNI policy bypass</h3>
<p class="cve-desc">Apache Traffic Server compares the TLS
SNI against the Host header with a length taken from the Host alone, so any SNI
that has the Host as a prefix bypasses host-SNI policy.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>TLS/SNI</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Access-control
bypass</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>JD Marsters (Bhut Red), Apache
Community</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>TLS/SNI</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Access-control
bypass</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>JD Marsters (Bhut Red), Apache
Community</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58182"; target="_blank"
rel="noopener">CVE-2026-58182</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.6</span></div>
<h3 class="cve-title">ts_lua plugin has initialization and
resource-handling errors</h3>
<p class="cve-desc">The Apache Traffic Server ts_lua
plugin mishandles initialization, transform context, and per-instance state.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
ts_lua</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
ts_lua</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58153"; target="_blank"
rel="noopener">CVE-2026-58153</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.3</span></div>
<h3 class="cve-title">HTTP/2 and HTTP/3 to HTTP/1
conversion can leak framing and trailers to clients</h3>
<p class="cve-desc">Apache Traffic Server can lose
per-stream framing and forward origin trailers when converting HTTP/2 or HTTP/3
to HTTP/1, enabling smuggling.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP/2 ·
HTTP/3 → HTTP/1</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Request smuggling</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP/2 ·
HTTP/3 → HTTP/1</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Request smuggling</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58159"; target="_blank"
rel="noopener">CVE-2026-58159</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.2</span></div>
<h3 class="cve-title">Listener and ACL handling allow
access-control bypass</h3>
<p class="cve-desc">Apache Traffic Server can bypass IP
access controls on UDS listeners and through ACL matching errors.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>Remap/ACL</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Access-control
bypass</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>Remap/ACL</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Access-control
bypass</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58184"; target="_blank"
rel="noopener">CVE-2026-58184</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.2</span></div>
<h3 class="cve-title">header_rewrite plugin cookie
handling can corrupt memory</h3>
<p class="cve-desc">The Apache Traffic Server
header_rewrite plugin can crash or corrupt memory during cookie operations.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
header_rewrite</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
header_rewrite</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58188"; target="_blank"
rel="noopener">CVE-2026-58188</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.2</span></div>
<h3 class="cve-title">Memory-safety and limit-bypass
errors across experimental plugins</h3>
<p class="cve-desc">Several Apache Traffic Server
experimental plugins have memory-safety and limit-bypass errors.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugins
(experimental)</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Yon Harlicaj,
Apache Community, Omkhar Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugins
(experimental)</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Yon Harlicaj,
Apache Community, Omkhar Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58179"; target="_blank"
rel="noopener">CVE-2026-58179</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 8.1</span></div>
<h3 class="cve-title">regex_remap plugin overflows the
stack from attacker input</h3>
<p class="cve-desc">The Apache Traffic Server regex_remap
plugin overflows the stack and integers from substitution input.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
regex_remap</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
regex_remap</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache
Community</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58163"; target="_blank"
rel="noopener">CVE-2026-58163</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
<h3 class="cve-title">Cache deserialization and lifetime
errors can corrupt state or crash the server</h3>
<p class="cve-desc">Apache Traffic Server mishandles
on-disk cache fields and object lifetimes, corrupting state or crashing.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>Cache</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>Cache</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58164"; target="_blank"
rel="noopener">CVE-2026-58164</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
<h3 class="cve-title">Remap configuration lifetime and
TOCTOU errors cause use-after-free</h3>
<p class="cve-desc">Apache Traffic Server has
use-after-free and time-of-check/time-of-use errors in remap configuration
handling.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Remap
config</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Remap
config</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58175"; target="_blank"
rel="noopener">CVE-2026-58175</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
<h3 class="cve-title">HostDB SRV handling leaks memory</h3>
<p class="cve-desc">Apache Traffic Server leaks memory
when handling HostDB SRV records.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>HostDB</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Denial of
service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar Arasaratnam</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HostDB</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Denial of
service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58178"; target="_blank"
rel="noopener">CVE-2026-58178</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
<h3 class="cve-title">ESI plugin allows uncontrolled
recursion and server-side request forgery</h3>
<p class="cve-desc">The Apache Traffic Server ESI plugin
can recurse without bound and fetch attacker-controlled URLs.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
ESI</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">SSRF</span><span class="type-tag">Denial of
service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
ESI</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">SSRF</span><span class="type-tag">Denial of
service</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58180"; target="_blank"
rel="noopener">CVE-2026-58180</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
<h3 class="cve-title">txn_box plugin overflows the stack
from attacker input</h3>
<p class="cve-desc">The Apache Traffic Server txn_box
plugin overflows the stack from attacker-controlled input.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
txn_box</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
txn_box</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache
Community</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58181"; target="_blank"
rel="noopener">CVE-2026-58181</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
<h3 class="cve-title">uri_signing and url_sig plugins can
exhaust the stack or crash</h3>
<p class="cve-desc">The Apache Traffic Server uri_signing
and url_sig plugins can exhaust the stack or crash on attacker input.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
uri_signing / url_sig</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Denial of service</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
uri_signing / url_sig</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Denial of service</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58186"; target="_blank"
rel="noopener">CVE-2026-58186</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
<h3 class="cve-title">webp_transform plugin decodes
unsafely and mislabels degraded responses</h3>
<p class="cve-desc">The Apache Traffic Server
webp_transform plugin can decode unsafely and serve mislabeled, cacheable
responses.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
webp_transform</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
webp_transform</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58189"; target="_blank"
rel="noopener">CVE-2026-58189</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.5</span></div>
<h3 class="cve-title">Plugins resetting the redirect
counter enable SSRF amplification</h3>
<p class="cve-desc">Apache Traffic Server allows
redirect-limit bypass when plugins reset the retry counter, enabling SSRF
amplification.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP state
machine</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">SSRF</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>HTTP state
machine</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">SSRF</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-24033"; target="_blank"
rel="noopener">CVE-2026-24033</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 7.2</span></div>
<h3 class="cve-title">Chunked extension quoted-string
parsing allows request smuggling</h3>
<p class="cve-desc">Apache Traffic Server terminates a
chunked-extension quoted-string at CRLF, so a smuggled request hidden in the
quoted value is parsed as a second request when ATS is a reverse proxy.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/1</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Rajat Raghav, Katsutoshi Ikenoya
(LY Corporation)</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HTTP/1</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Request
smuggling</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Rajat Raghav, Katsutoshi Ikenoya
(LY Corporation)</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58160"; target="_blank"
rel="noopener">CVE-2026-58160</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 6.5</span></div>
<h3 class="cve-title">Out-of-bounds reads while parsing
DNS responses</h3>
<p class="cve-desc">Apache Traffic Server reads out of
bounds while parsing DNS answers.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>DNS</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>DNS</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache Community, Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58152"; target="_blank"
rel="noopener">CVE-2026-58152</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 5.9</span></div>
<h3 class="cve-title">Integer-handling errors in
HPACK/XPACK decoding corrupt memory</h3>
<p class="cve-desc">Apache Traffic Server mishandles
integers while decoding HPACK/XPACK headers, corrupting memory.</p>
- <dl
class="cve-meta"><div><dt>Component</dt><dd>HPACK/XPACK</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
+ <dl
class="cve-meta"><div><dt>Component</dt><dd>HPACK/XPACK</dd></div><div><dt>Type</dt><dd
class="type-dd"><span class="type-tag">Memory
safety</span></dd></div><div><dt>Fixed in</dt><dd>9.2.15 /
10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache Community</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58158"; target="_blank"
rel="noopener">CVE-2026-58158</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 5.9</span></div>
<h3 class="cve-title">PROXY protocol parsing has port
truncation and a stack overflow</h3>
<p class="cve-desc">Apache Traffic Server mishandles PROXY
protocol input, truncating ports and overflowing the stack.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>PROXY
protocol</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>PROXY
protocol</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache
Community</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58183"; target="_blank"
rel="noopener">CVE-2026-58183</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 5.9</span></div>
<h3 class="cve-title">prefetch plugin can crash on
attacker-influenced input</h3>
<p class="cve-desc">The Apache Traffic Server prefetch
plugin can crash when processing attacker-influenced input.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
prefetch</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Denial of service</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
prefetch</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Denial of service</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58185"; target="_blank"
rel="noopener">CVE-2026-58185</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 5.9</span></div>
<h3 class="cve-title">Use-after-free in the intercept
plugin</h3>
<p class="cve-desc">The Apache Traffic Server intercept
plugin has a use-after-free.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
intercept</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
intercept</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Memory safety</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58156"; target="_blank"
rel="noopener">CVE-2026-58156</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 4.9</span></div>
<h3 class="cve-title">URL and port parsing errors allow
access-control bypass</h3>
<p class="cve-desc">Apache Traffic Server mis-parses ports
in URLs and userinfo, allowing port-based access-control bypass.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>URL
parsing</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Access-control bypass</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>URL
parsing</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Access-control bypass</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Apache
Community, Omkhar Arasaratnam</dd></div></dl>
</article>
<article class="cve-card" style="border-left-color:#d97706">
<div class="cve-top"><span class="cve-id"><a
href="https://www.cve.org/CVERecord?id=CVE-2026-58187"; target="_blank"
rel="noopener">CVE-2026-58187</a></span><span class="pill
pill-moderate">Moderate</span><span class="cvss">CVSS 3.7</span></div>
<h3 class="cve-title">Multiplexer plugin chunk decoder
enables a denial of service</h3>
<p class="cve-desc">The Apache Traffic Server multiplexer
plugin overruns its chunk-decode buffer on upstream input, enabling denial of
service.</p>
- <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
multiplexer</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Denial of service</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.3</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
+ <dl class="cve-meta"><div><dt>Component</dt><dd>Plugin:
multiplexer</dd></div><div><dt>Type</dt><dd class="type-dd"><span
class="type-tag">Denial of service</span></dd></div><div><dt>Fixed
in</dt><dd>9.2.15 / 10.1.4</dd></div><div><dt>Reported by</dt><dd>Omkhar
Arasaratnam</dd></div></dl>
</article>
</div>
</div>
