Apache Traffic Server

Transfer-Encoding not treated as hop-by-hop

The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.

Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work

Apache Traffic Server: Invalid Range header causes a crash

HTTP request line fuzzing attacks

Improper input validation on HTTP/2 headers

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.

ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.

Apache Traffic Server: The TRACE method can be use to disclose network information

Apache Traffic Server: s3_auth plugin problem with hash calculation

Apache Traffic Server: Improperly handled requests can cause crashes in specific plugins

Apache Traffic Server: s3_auth plugin problem with hash calculation

Apache Traffic Server: Incomplete field name check allows request smuggling

Apache Traffic Server: Valid Host field value can cause crashes

Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack

Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin

Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions

Apache Traffic Server: A simple legitimate POST request causes a crash

Apache Traffic Server: Malformed chunked message body allows request smuggling

Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL

Apache Traffic Server: Malformed chunked message body allows request smuggling

Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service

Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing

Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory

There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

Apache Traffic Server: Out-of-bounds reads while parsing DNS responses

In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation.

Apache Traffic Server: Request smuggling via pipelining after a chunked message body

Apache Traffic Server: Intercept plugins are not access controlled

Apache Traffic Server: ACL is not fully compatible with older versions

Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

Apache Traffic Server: URL and port parsing errors allow access-control bypass

Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification

Apache Traffic Server: Security issues with the xdebug plugin

Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

Apache Traffic Server: Improperly reading the client requests

Apache Traffic Server before 5.1.2 allows remote attackers to cause a denial of service via unspecified vectors, related to internal buffer sizing.

Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.

Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to validate responses, which makes it easier for man-in-the-middle attackers to poison the internal DNS cache via a crafted response.