Apache Traffic Server

Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash

Apache Traffic Server: prefetch plugin can crash on attacker-influenced input

Apache Traffic Server: Buffer overflow via Host field that has a long string value

Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow

Apache Traffic Server: Listener and ACL handling allow access-control bypass

Not validating origin TLS certificate

Improper authentication vulnerability in TLS origin verification

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

Apache Traffic Server: Malformed http/2 frames can cause an abort

Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.

Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions.

Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.

Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.

Incorrect handling of url fragment leads to cache poisoning

Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.

Request Smuggling - transfer encoding validation

Request Smuggling - multiple attacks

Request Smuggling - LF line ending

Specific sequence of HTTP/2 frames can cause ATS to crash

ATS stops accepting connections on FreeBSD

Reading HTTP/2 frames too many times

Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.

Improper HTTP/2 scheme and method validation

Insufficient Validation of HTTP/1.x Headers

HTTP/2 framing vulnerabilities

There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump.

Protocol vs scheme mismatch

HTTP Request Smuggling, content length with invalid charters