Apache

Traffic Server

80 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2025-49763

  • EPSS 0.32%
  • Veröffentlicht 19.06.2025 10:15:21
  • Zuletzt bearbeitet 01.07.2025 20:15:05

ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects A...

7.5

CVE-2025-31698

  • EPSS 0.11%
  • Veröffentlicht 19.06.2025 10:15:20
  • Zuletzt bearbeitet 01.07.2025 20:14:42

ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is conf...

7.5

CVE-2024-53868

  • EPSS 0.23%
  • Veröffentlicht 03.04.2025 09:15:15
  • Zuletzt bearbeitet 29.04.2025 20:42:23

Apache Traffic Server allows request smuggling if chunked messages are malformed.  This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, whi...

6.3

CVE-2024-56196

  • EPSS 0.38%
  • Veröffentlicht 06.03.2025 12:15:35
  • Zuletzt bearbeitet 07.05.2025 16:36:33

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 10.0.4, which fixes the issue.

6.3

CVE-2024-56195

  • EPSS 0.45%
  • Veröffentlicht 06.03.2025 12:15:35
  • Zuletzt bearbeitet 29.04.2025 16:42:01

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

6.3

CVE-2024-38311

  • EPSS 0.66%
  • Veröffentlicht 06.03.2025 12:15:34
  • Zuletzt bearbeitet 29.04.2025 16:34:58

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4...

4.3

CVE-2024-56202

  • EPSS 0.68%
  • Veröffentlicht 06.03.2025 11:15:11
  • Zuletzt bearbeitet 29.04.2025 16:41:26

Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes t...

6.5

CVE-2018-9481

  • EPSS 0.03%
  • Veröffentlicht 20.11.2024 18:15:19
  • Zuletzt bearbeitet 18.12.2024 18:49:52

In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction i...

7.5

CVE-2024-50305

  • EPSS 1.68%
  • Veröffentlicht 14.11.2024 10:15:08
  • Zuletzt bearbeitet 04.06.2025 16:15:49

Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does ...

9.1

CVE-2024-50306

  • EPSS 2.95%
  • Veröffentlicht 14.11.2024 10:15:08
  • Zuletzt bearbeitet 04.06.2025 16:15:30

Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, whi...