Technology · Apache
Apache Traffic Server vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 55 vulnerabilities in Apache Traffic Server: 0 in the last 7 days and 16 in the last 90 days, 14 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112381, was published on 21 October 2026. 15 vulnerabilities in the last four weeks, up 1400% on the four before (1). 7 critical against 1.
- Last 7 days
- 0
- Last 90 days
- 16
- Critical, all time
- 14
- Exploited in the wild
- 0
About Apache Traffic Server
Apache reverse proxy and HTTP caching server.
Latest Apache Traffic Server vulnerabilities
- CVE-2026-112381: Apache Traffic Server null pointer dereference in request tear-downmediumCVSS 5.9
- CVE-2026-111817: Apache Traffic Server connection stall with chunked transfer trailers droppedmediumCVSS 5.3
- CVE-2026-111815: Apache Traffic Server TLS session resumption bypass of client certificate verificationcriticalCVSS 10
- CVE-2026-111814: Apache Traffic Server TLS session reuse with mismatched client certificatescriticalCVSS 10
- CVE-2026-111812: Apache Traffic Server origin_server_auth AWS request signing bypasscriticalCVSS 10
- CVE-2026-111811: Apache Traffic Server tsmemcache plugin unauthenticated cache accesscriticalCVSS 9
- CVE-2026-111810: Apache Traffic Server unthrottled logging on header strippinghighCVSS 7.5
- CVE-2026-111809: Apache Traffic Server request smuggling via HEAD requestscriticalCVSS 9.3
- CVE-2026-111808: Apache Traffic Server worker pool exhaustion via malformed HTTP/2 DATA framehighCVSS 8.6
- CVE-2026-111805: Apache Traffic Server HTTP/2 request smuggling via truncated Content-LengthhighCVSS 8.6
- CVE-2026-111816: Apache Traffic Server malformed response cache poisoningcriticalCVSS 9.3
- CVE-2026-111813: Apache Traffic Server command injection in magick plugincriticalCVSS 10
- CVE-2026-111804: Apache Traffic Server use-after-free and metric ID validation bypass in wasm pluginhighCVSS 8.2
- CVE-2025-55702: Apache Traffic Server HTTP request smuggling via Expect: 100-continuehighCVSS 8.7
- CVE-2025-31699: Apache Traffic Server HTTP request smuggling via incomplete request bodieshighCVSS 8.9
- CVE-2026-102795: Apache Traffic Server improper access controlcriticalCVSS 9.3EPSS 0.3%
- CVE-2026-65100: Apache Traffic Server HTTP/2 HPACK dynamic table corruptionmediumCVSS 4.8
- CVE-2026-58189: Apache Traffic Server SSRF amplification via redirect-limit bypasshighCVSS 7.5
- CVE-2026-58188: Apache Traffic Server memory safety and limit bypass in experimental pluginshighCVSS 8.2
- CVE-2026-58187: Apache Traffic Server out-of-bounds write in multiplexer pluginlowCVSS 3.7
- CVE-2026-58186: Apache Traffic Server unsafe decoding in webp_transform pluginhighCVSS 7.5
- CVE-2026-58184: Apache Traffic Server memory corruption in header_rewrite pluginhighCVSS 8.2
- CVE-2026-58183: Apache Traffic Server denial of service in prefetch pluginmediumCVSS 5.9
- CVE-2026-58182: Apache Traffic Server state mishandling in ts_lua pluginhighCVSS 8.6
- CVE-2026-58181: Apache Traffic Server stack exhaustion in uri_signing and url_sig pluginshighCVSS 7.5
Most severe Apache Traffic Server vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-111815: Apache Traffic Server TLS session resumption bypass of client certificate verificationcriticalCVSS 10
- CVE-2026-111814: Apache Traffic Server TLS session reuse with mismatched client certificatescriticalCVSS 10
- CVE-2026-111812: Apache Traffic Server origin_server_auth AWS request signing bypasscriticalCVSS 10
- CVE-2026-111813: Apache Traffic Server command injection in magick plugincriticalCVSS 10
- CVE-2026-58162: Apache Traffic Server improper certificate validation in certifier plugincriticalCVSS 10
- CVE-2026-58150: Apache Traffic Server request smuggling in HTTP/2 downgradecriticalCVSS 10
- CVE-2026-57834: Apache Traffic Server request smuggling via malformed chunked messagescriticalCVSS 10
- CVE-2026-33267: Apache Traffic Server improper input validationcriticalCVSS 10
- CVE-2026-102795: Apache Traffic Server improper access controlcriticalCVSS 9.3EPSS 0.3%
- CVE-2026-111809: Apache Traffic Server request smuggling via HEAD requestscriticalCVSS 9.3
Vulnerabilities per week
15 vulnerabilities in the last four weeks, up 1400% on the four before (1). 7 critical against 1. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 1 | 1 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 15 | 7 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Apache Traffic Server vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/traffic-server)<a href="https://junglewise.ai/threats/technologies/traffic-server"><img src="https://junglewise.ai/threats/technologies/traffic-server/badge.svg" alt="Apache Traffic Server vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/traffic-server.json, and this page as text at https://junglewise.ai/threats/technologies/traffic-server.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Apache Traffic Server vulnerabilities", https://junglewise.ai/threats/technologies/traffic-server, 12 November 2026.