traffic server CVEs

Look up CVE IDs Status Exploitation Severity

Reset

Overview 122 matches · 1 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 2 public PoC · 9 EPSS ≥ 0.5

122matches 1in Waratek scope0.8% 0protected0.0% 1exploited0.8% 1CISA KEV0.8% 2public PoC1.6% 9EPSS ≥ 0.57.4%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 0.8% No exploit published 0 0.0% Outside Waratek scope 6 4.9% Not applicable 115 94.3% Withdrawn CVE 0 0.0%

Critical 16 13.1% High 82 67.2% Medium 24 19.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 122 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 0.8% Working exploit published 1 0.8% Proof of concept only 0 0.0% Forecast only 8 6.6% No public exploit 112 91.8%

split by StatusSeverityProtectionExploit maturity peak 41 / year

20021 Not applicable1 High1 not blocked1 Working exploit published1 20030 20040 20050 20060 20070 20080 20090 20101 Not applicable1 Medium1 not blocked1 No public exploit1 20110 20121 Not applicable1 Medium1 not blocked1 No public exploit1 20130 20141 Not applicable1 High1 not blocked1 No public exploit1 20151 Not applicable1 Medium1 not blocked1 No public exploit1 20160 20176 Not applicable6 Critical4 High2 not blocked6 No public exploit6 20187 Not applicable7 High4 Medium3 not blocked7 No public exploit7 201910 Outside Waratek scope6 Not applicable4 High9 Medium1 not blocked10 Forecast only6 No public exploit4 20205 Not applicable5 Critical3 High2 not blocked5 No public exploit5 202114 Not applicable14 Critical2 High12 not blocked14 No public exploit14 202211 Not applicable11 High9 Medium2 not blocked11 No public exploit11 20238 Mitigation candidate1 Not applicable7 Critical1 High7 not blocked8 Exploited1 Forecast only1 No public exploit6 20248 Not applicable8 Critical2 High5 Medium1 not blocked8 Forecast only1 No public exploit7 20257 Not applicable7 High3 Medium4 not blocked7 No public exploit7 202641 Not applicable41 Critical4 High27 Medium10 not blocked41 No public exploit41

2002200420062008201020122014201620182020202220242026

122 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2019-9513	High	2019-08-13	Outside Waratek scope	Forecast only	Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
CVE-2019-9512	High	2019-08-13	Not applicable	Forecast only	Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVE-2019-9511	High	2019-08-13	Outside Waratek scope	Forecast only	Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVE-2018-11783	High	2019-03-07	Not applicable	No public exploit	sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.
CVE-2018-8040	Medium	2018-08-29	Not applicable	No public exploit	Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
CVE-2018-8022	High	2018-08-29	Not applicable	No public exploit	A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.
CVE-2018-8005	Medium	2018-08-29	Not applicable	No public exploit	When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
CVE-2018-8004	Medium	2018-08-29	Not applicable	No public exploit	There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
CVE-2018-1318	High	2018-08-29	Not applicable	No public exploit	Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
CVE-2017-7671	High	2018-02-27	Not applicable	No public exploit	There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump.
CVE-2017-5660	High	2018-02-27	Not applicable	No public exploit	There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.
CVE-2015-3249	Critical	2017-10-30	Not applicable	No public exploit	The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.
CVE-2014-3624	Critical	2017-10-30	Not applicable	No public exploit	Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT.
CVE-2015-5206	Critical	2017-09-13	Not applicable	No public exploit	Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.
CVE-2015-5168	Critical	2017-09-13	Not applicable	No public exploit	Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5206.
CVE-2017-5659	High	2017-04-17	Not applicable	No public exploit	Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.
CVE-2016-5396	High	2017-04-17	Not applicable	No public exploit	Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.
CVE-2014-10022	Medium	2015-01-13	Not applicable	No public exploit	Apache Traffic Server before 5.1.2 allows remote attackers to cause a denial of service via unspecified vectors, related to internal buffer sizing.
CVE-2014-3525	High	2014-08-22	Not applicable	No public exploit	Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.
CVE-2012-0256	Medium	2012-03-26	Not applicable	No public exploit	Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.
CVE-2010-2952	Medium	2010-09-13	Not applicable	No public exploit	Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to validate responses, which makes it easier for man-in-the-middle attackers to poison the internal DNS cache via a crafted response.
CVE-2002-1013	High	2002-10-04	Not applicable	Working exploit published	Buffer overflow in traffic_manager for Inktomi Traffic Server 4.0.18 through 5.2.2, Traffic Edge 1.1.2 and 1.5.0, and Media-IXT 3.0.4 allows local users to gain root privileges via a long -path argument.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2019-9513

High

2019-08-13

Outside Waratek scope

Forecast only

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

CVE-2019-9512

High

2019-08-13

Not applicable

Forecast only

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVE-2019-9511

High

2019-08-13

Outside Waratek scope

Forecast only

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVE-2018-11783

High

2019-03-07

Not applicable

No public exploit

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.

CVE-2018-8040

Medium

2018-08-29

Not applicable

No public exploit

Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

CVE-2018-8022

High

2018-08-29

Not applicable

No public exploit

A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.

CVE-2018-8005

Medium

2018-08-29

Not applicable

No public exploit

When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

CVE-2018-8004

Medium

2018-08-29

Not applicable

No public exploit

There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

CVE-2018-1318

High

2018-08-29

Not applicable

No public exploit

Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

CVE-2017-7671

High

2018-02-27

Not applicable

No public exploit

There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump.

CVE-2017-5660

High

2018-02-27

Not applicable

No public exploit

There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.

CVE-2015-3249

Critical

2017-10-30

Not applicable

No public exploit

The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.

CVE-2014-3624

Critical

2017-10-30

Not applicable

No public exploit

Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT.

CVE-2015-5206

Critical

2017-09-13

Not applicable

No public exploit

Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.

CVE-2015-5168

Critical

2017-09-13

Not applicable

No public exploit

Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5206.

CVE-2017-5659

High

2017-04-17

Not applicable

No public exploit

Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.

CVE-2016-5396

High

2017-04-17

Not applicable

No public exploit

Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.

CVE-2014-10022

Medium

2015-01-13

Not applicable

No public exploit

Apache Traffic Server before 5.1.2 allows remote attackers to cause a denial of service via unspecified vectors, related to internal buffer sizing.

CVE-2014-3525

High

2014-08-22

Not applicable

No public exploit

Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2012-0256

Medium

2012-03-26

Not applicable

No public exploit

Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.

CVE-2010-2952

Medium

2010-09-13

Not applicable

No public exploit

Apache Traffic Server before 2.0.1, and 2.1.x before 2.1.2-unstable, does not properly choose DNS source ports and transaction IDs, and does not properly use DNS query fields to validate responses, which makes it easier for man-in-the-middle attackers to poison the internal DNS cache via a crafted response.

CVE-2002-1013

High

2002-10-04

Not applicable

Working exploit published

Buffer overflow in traffic_manager for Inktomi Traffic Server 4.0.18 through 5.2.2, Traffic Edge 1.1.2 and 1.5.0, and Media-IXT 3.0.4 allows local users to gain root privileges via a long -path argument.