| CVE-2026-111812 |
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers…
|
10.0
Critique
|
21 oct. 2026 |
| CVE-2026-111811 |
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the…
|
9.0
Critique
|
21 oct. 2026 |
| CVE-2026-111809 |
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding
|
9.3
Critique
|
21 oct. 2026 |
| CVE-2026-111815 |
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate…
|
10.0
Critique
|
21 oct. 2026 |
| CVE-2026-111814 |
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one…
|
10.0
Critique
|
21 oct. 2026 |
| CVE-2026-111816 |
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the…
|
9.3
Critique
|
21 oct. 2026 |
| CVE-2026-111813 |
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert…
|
10.0
Critique
|
21 oct. 2026 |
| CVE-2026-102795 |
Improper Access Control vulnerability in Apache Traffic Server
|
9.3
Critique
|
2 oct. 2026 |
| CVE-2026-58162 |
The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI
|
10.0
Critique
|
29 juil. 2026 |
| CVE-2026-58155 |
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass
|
9.3
Critique
|
29 juil. 2026 |
| CVE-2026-58150 |
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling
|
10.0
Critique
|
29 juil. 2026 |
| CVE-2026-57834 |
Apache Traffic Server allows request smuggling if chunked messages are malformed
|
10.0
Critique
|
29 juil. 2026 |
| CVE-2026-33267 |
Improper Input Validation vulnerability in Apache Traffic Server
|
10.0
Critique
|
29 juil. 2026 |
| CVE-2026-41920 |
Improper Access Control vulnerability in Apache Traffic Server
|
9.3
Critique
|
29 juil. 2026 |