Aller au contenu
en Se connecter
10.0 Critique

CVE-2026-111815 Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate…

Description

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Traffic Server 10.2.0 Pas de correctif indiqué
Apache Traffic Server 10.0 10.0.0 → 10.1.4 Pas de correctif indiqué
Apache Traffic Server 9.0 9.0.0 → 9.2.15 Pas de correctif indiqué
Apache Traffic Server 8.0 8.0.0 → 8.1.11 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache Traffic Server

Les 111 CVE de Apache Traffic Server →
CVE-2026-112381 Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close… 5.9 Moyenne CVE-2026-111817 Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed… 5.3 Moyenne CVE-2026-111812 Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers… 10.0 Critique CVE-2026-111811 Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the… 9.0 Critique
Suivre cette CVE