{"schema_version":1,"title":"Apache Traffic Server vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 39 vulnerabilities in Apache Traffic Server: 0 in the last 7 days and 37 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-65100, was published on 29 July 2026.","url":"https://junglewise.ai/threats/technologies/traffic-server","json_url":"https://junglewise.ai/threats/technologies/traffic-server.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/traffic-server","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":23,"all_time":39,"critical":6,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":37,"last_365_days":39},"latest":[{"cve":"CVE-2026-65100","cvss":4.8,"slug":"cve-2026-65100-apache-traffic-server-http-2-hpack-dynamic-table-corruption","title":"Apache Traffic Server HTTP/2 HPACK dynamic table corruption","severity":"medium","exploited":false,"published_at":"2026-07-29T10:16:44.523+00:00","url":"https://junglewise.ai/threats/cve-2026-65100-apache-traffic-server-http-2-hpack-dynamic-table-corruption"},{"cve":"CVE-2026-58189","cvss":7.5,"slug":"cve-2026-58189-apache-traffic-server-ssrf-amplification-via-redirect-limit","title":"Apache Traffic Server SSRF amplification via redirect-limit bypass","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:44.243+00:00","url":"https://junglewise.ai/threats/cve-2026-58189-apache-traffic-server-ssrf-amplification-via-redirect-limit"},{"cve":"CVE-2026-58188","cvss":8.2,"slug":"cve-2026-58188-apache-traffic-server-memory-safety-and-limit-bypass-in","title":"Apache Traffic Server memory safety and limit bypass in experimental plugins","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:44.093+00:00","url":"https://junglewise.ai/threats/cve-2026-58188-apache-traffic-server-memory-safety-and-limit-bypass-in"},{"cve":"CVE-2026-58187","cvss":3.7,"slug":"cve-2026-58187-apache-traffic-server-out-of-bounds-write-in-multiplexer-plugin","title":"Apache Traffic Server out-of-bounds write in multiplexer plugin","severity":"low","exploited":false,"published_at":"2026-07-29T10:16:43.95+00:00","url":"https://junglewise.ai/threats/cve-2026-58187-apache-traffic-server-out-of-bounds-write-in-multiplexer-plugin"},{"cve":"CVE-2026-58186","cvss":7.5,"slug":"cve-2026-58186-apache-traffic-server-unsafe-decoding-in-webp-transform-plugin","title":"Apache Traffic Server unsafe decoding in webp_transform plugin","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:43.807+00:00","url":"https://junglewise.ai/threats/cve-2026-58186-apache-traffic-server-unsafe-decoding-in-webp-transform-plugin"},{"cve":"CVE-2026-58184","cvss":8.2,"slug":"cve-2026-58184-apache-traffic-server-memory-corruption-in-header-rewrite-plugin","title":"Apache Traffic Server memory corruption in header_rewrite plugin","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:43.52+00:00","url":"https://junglewise.ai/threats/cve-2026-58184-apache-traffic-server-memory-corruption-in-header-rewrite-plugin"},{"cve":"CVE-2026-58183","cvss":5.9,"slug":"cve-2026-58183-apache-traffic-server-denial-of-service-in-prefetch-plugin","title":"Apache Traffic Server denial of service in prefetch plugin","severity":"medium","exploited":false,"published_at":"2026-07-29T10:16:43.373+00:00","url":"https://junglewise.ai/threats/cve-2026-58183-apache-traffic-server-denial-of-service-in-prefetch-plugin"},{"cve":"CVE-2026-58182","cvss":8.6,"slug":"cve-2026-58182-apache-traffic-server-state-mishandling-in-ts-lua-plugin","title":"Apache Traffic Server state mishandling in ts_lua plugin","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:43.23+00:00","url":"https://junglewise.ai/threats/cve-2026-58182-apache-traffic-server-state-mishandling-in-ts-lua-plugin"},{"cve":"CVE-2026-58181","cvss":7.5,"slug":"cve-2026-58181-apache-traffic-server-stack-exhaustion-in-uri-signing-and-url-sig","title":"Apache Traffic Server stack exhaustion in uri_signing and url_sig plugins","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:43.087+00:00","url":"https://junglewise.ai/threats/cve-2026-58181-apache-traffic-server-stack-exhaustion-in-uri-signing-and-url-sig"},{"cve":"CVE-2026-58180","cvss":7.5,"slug":"cve-2026-58180-apache-traffic-server-stack-overflow-in-txn-box-plugin","title":"Apache Traffic Server stack overflow in txn_box plugin","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:42.947+00:00","url":"https://junglewise.ai/threats/cve-2026-58180-apache-traffic-server-stack-overflow-in-txn-box-plugin"},{"cve":"CVE-2026-58179","cvss":8.1,"slug":"cve-2026-58179-apache-traffic-server-stack-overflow-in-regex-remap-plugin","title":"Apache Traffic Server stack overflow in regex_remap plugin","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:42.803+00:00","url":"https://junglewise.ai/threats/cve-2026-58179-apache-traffic-server-stack-overflow-in-regex-remap-plugin"},{"cve":"CVE-2026-58178","cvss":7.5,"slug":"cve-2026-58178-apache-traffic-server-uncontrolled-recursion-in-esi-plugin","title":"Apache Traffic Server uncontrolled recursion in ESI plugin","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:42.657+00:00","url":"https://junglewise.ai/threats/cve-2026-58178-apache-traffic-server-uncontrolled-recursion-in-esi-plugin"},{"cve":"CVE-2026-58177","cvss":8.1,"slug":"cve-2026-58177-apache-traffic-server-multiple-vulnerabilities-in-cripts","title":"Apache Traffic Server multiple vulnerabilities in Cripts framework","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:42.51+00:00","url":"https://junglewise.ai/threats/cve-2026-58177-apache-traffic-server-multiple-vulnerabilities-in-cripts"},{"cve":"CVE-2026-58175","cvss":7.5,"slug":"cve-2026-58175-apache-traffic-server-memory-leak-in-hostdb-srv-record-handling","title":"Apache Traffic Server memory leak in HostDB SRV record handling","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:42.36+00:00","url":"https://junglewise.ai/threats/cve-2026-58175-apache-traffic-server-memory-leak-in-hostdb-srv-record-handling"},{"cve":"CVE-2026-58164","cvss":7.5,"slug":"cve-2026-58164-apache-traffic-server-use-after-free-in-remap-configuration","title":"Apache Traffic Server use-after-free in remap configuration handling","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:42.217+00:00","url":"https://junglewise.ai/threats/cve-2026-58164-apache-traffic-server-use-after-free-in-remap-configuration"},{"cve":"CVE-2026-58163","cvss":7.5,"slug":"cve-2026-58163-apache-traffic-server-deserialization-vulnerability-in-cache","title":"Apache Traffic Server deserialization vulnerability in cache component","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:42.073+00:00","url":"https://junglewise.ai/threats/cve-2026-58163-apache-traffic-server-deserialization-vulnerability-in-cache"},{"cve":"CVE-2026-58162","cvss":10,"slug":"cve-2026-58162-apache-traffic-server-improper-certificate-validation-in","title":"Apache Traffic Server improper certificate validation in certifier plugin","severity":"critical","exploited":false,"published_at":"2026-07-29T10:16:41.927+00:00","url":"https://junglewise.ai/threats/cve-2026-58162-apache-traffic-server-improper-certificate-validation-in"},{"cve":"CVE-2026-58161","cvss":7.5,"slug":"cve-2026-58161-apache-traffic-server-denial-of-service-in-tls-and-sni-handling","title":"Apache Traffic Server denial of service in TLS and SNI handling","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:41.78+00:00","url":"https://junglewise.ai/threats/cve-2026-58161-apache-traffic-server-denial-of-service-in-tls-and-sni-handling"},{"cve":"CVE-2026-58160","cvss":6.5,"slug":"cve-2026-58160-apache-traffic-server-out-of-bounds-read-in-dns-parsing","title":"Apache Traffic Server out-of-bounds read in DNS parsing","severity":"medium","exploited":false,"published_at":"2026-07-29T10:16:41.637+00:00","url":"https://junglewise.ai/threats/cve-2026-58160-apache-traffic-server-out-of-bounds-read-in-dns-parsing"},{"cve":"CVE-2026-58158","cvss":5.9,"slug":"cve-2026-58158-apache-traffic-server-stack-overflow-in-proxy-protocol-handling","title":"Apache Traffic Server stack overflow in PROXY protocol handling","severity":"medium","exploited":false,"published_at":"2026-07-29T10:16:41.347+00:00","url":"https://junglewise.ai/threats/cve-2026-58158-apache-traffic-server-stack-overflow-in-proxy-protocol-handling"},{"cve":"CVE-2026-58157","cvss":8.7,"slug":"cve-2026-58157-apache-traffic-server-session-and-tunnel-reuse-data-exposure","title":"Apache Traffic Server session and tunnel reuse data exposure","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:41.173+00:00","url":"https://junglewise.ai/threats/cve-2026-58157-apache-traffic-server-session-and-tunnel-reuse-data-exposure"},{"cve":"CVE-2026-65325","cvss":4.8,"slug":"cve-2026-65325-apache-traffic-server-improper-certificate-validation-in-http-2","title":"Apache Traffic Server improper certificate validation in HTTP/2 origin reuse","severity":"medium","exploited":false,"published_at":"2026-07-29T09:16:30.543+00:00","url":"https://junglewise.ai/threats/cve-2026-65325-apache-traffic-server-improper-certificate-validation-in-http-2"},{"cve":"CVE-2026-65324","cvss":7.5,"slug":"cve-2026-65324-apache-traffic-server-memory-exhaustion-in-http-2-and-http-3","title":"Apache Traffic Server memory exhaustion in HTTP/2 and HTTP/3 dechunking","severity":"high","exploited":false,"published_at":"2026-07-29T09:16:30.41+00:00","url":"https://junglewise.ai/threats/cve-2026-65324-apache-traffic-server-memory-exhaustion-in-http-2-and-http-3"},{"cve":"CVE-2026-58156","cvss":4.9,"slug":"cve-2026-58156-apache-traffic-server-port-based-access-control-bypass","title":"Apache Traffic Server port-based access control bypass","severity":"medium","exploited":false,"published_at":"2026-07-29T09:16:30.023+00:00","url":"https://junglewise.ai/threats/cve-2026-58156-apache-traffic-server-port-based-access-control-bypass"},{"cve":"CVE-2026-58155","cvss":9.3,"slug":"cve-2026-58155-apache-traffic-server-request-smuggling-via-header-truncation","title":"Apache Traffic Server request smuggling via header truncation","severity":"critical","exploited":false,"published_at":"2026-07-29T09:16:29.877+00:00","url":"https://junglewise.ai/threats/cve-2026-58155-apache-traffic-server-request-smuggling-via-header-truncation"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":6,"exploited":0,"vulnerabilities":36},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Apache Tomcat","slug":"tomcat","vulnerabilities":67,"url":"https://junglewise.ai/threats/technologies/tomcat"},{"name":"Apache Airflow","slug":"airflow","vulnerabilities":61,"url":"https://junglewise.ai/threats/technologies/airflow"},{"name":"Apache Camel","slug":"camel","vulnerabilities":40,"url":"https://junglewise.ai/threats/technologies/camel"},{"name":"Apache HTTP Server","slug":"http-server","vulnerabilities":31,"url":"https://junglewise.ai/threats/technologies/http-server"},{"name":"Apache CloudStack","slug":"cloudstack","vulnerabilities":25,"url":"https://junglewise.ai/threats/technologies/cloudstack"},{"name":"Apache Ofbiz","slug":"ofbiz","vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/ofbiz"},{"name":"Apache ActiveMQ","slug":"activemq","vulnerabilities":19,"url":"https://junglewise.ai/threats/technologies/activemq"},{"name":"Apache Storm","slug":"storm","vulnerabilities":17,"url":"https://junglewise.ai/threats/technologies/storm"},{"name":"Apache Apisix","slug":"apisix","vulnerabilities":16,"url":"https://junglewise.ai/threats/technologies/apisix"},{"name":"Apache Thrift","slug":"thrift","vulnerabilities":16,"url":"https://junglewise.ai/threats/technologies/thrift"},{"name":"Apache ActiveMQ Artemis","slug":"activemq-artemis","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/activemq-artemis"},{"name":"Apache Ranger","slug":"ranger","vulnerabilities":12,"url":"https://junglewise.ai/threats/technologies/ranger"}],"technology":{"hub":true,"name":"Apache Traffic Server","slug":"traffic-server","vendor":{"name":"Apache","slug":"apache","url":"https://junglewise.ai/threats/vendors/apache"},"aliases":[],"category":"web-server","homepage":"https://trafficserver.apache.org/","repo_url":"https://github.com/apache/trafficserver","description":"Traffic Server is a high-performance HTTP proxy and caching server.","url":"https://junglewise.ai/threats/technologies/traffic-server"},"most_severe":[{"cve":"CVE-2026-58162","cvss":10,"slug":"cve-2026-58162-apache-traffic-server-improper-certificate-validation-in","title":"Apache Traffic Server improper certificate validation in certifier plugin","severity":"critical","exploited":false,"published_at":"2026-07-29T10:16:41.927+00:00","url":"https://junglewise.ai/threats/cve-2026-58162-apache-traffic-server-improper-certificate-validation-in"},{"cve":"CVE-2026-58150","cvss":10,"slug":"cve-2026-58150-apache-traffic-server-request-smuggling-in-http-2-downgrade","title":"Apache Traffic Server request smuggling in HTTP/2 downgrade","severity":"critical","exploited":false,"published_at":"2026-07-29T08:16:31.71+00:00","url":"https://junglewise.ai/threats/cve-2026-58150-apache-traffic-server-request-smuggling-in-http-2-downgrade"},{"cve":"CVE-2026-57834","cvss":10,"slug":"cve-2026-57834-apache-traffic-server-request-smuggling-via-malformed-chunked","title":"Apache Traffic Server request smuggling via malformed chunked messages","severity":"critical","exploited":false,"published_at":"2026-07-29T08:16:31.563+00:00","url":"https://junglewise.ai/threats/cve-2026-57834-apache-traffic-server-request-smuggling-via-malformed-chunked"},{"cve":"CVE-2026-33267","cvss":10,"slug":"cve-2026-33267-apache-traffic-server-improper-input-validation","title":"Apache Traffic Server improper input validation","severity":"critical","exploited":false,"published_at":"2026-07-29T08:16:30.983+00:00","url":"https://junglewise.ai/threats/cve-2026-33267-apache-traffic-server-improper-input-validation"},{"cve":"CVE-2026-58155","cvss":9.3,"slug":"cve-2026-58155-apache-traffic-server-request-smuggling-via-header-truncation","title":"Apache Traffic Server request smuggling via header truncation","severity":"critical","exploited":false,"published_at":"2026-07-29T09:16:29.877+00:00","url":"https://junglewise.ai/threats/cve-2026-58155-apache-traffic-server-request-smuggling-via-header-truncation"},{"cve":"CVE-2026-41920","cvss":9.3,"slug":"cve-2026-41920-apache-traffic-server-improper-access-control","title":"Apache Traffic Server improper access control","severity":"critical","exploited":false,"published_at":"2026-07-29T08:16:31.42+00:00","url":"https://junglewise.ai/threats/cve-2026-41920-apache-traffic-server-improper-access-control"},{"cve":"CVE-2026-58154","cvss":8.9,"slug":"cve-2026-58154-apache-traffic-server-out-of-bounds-write-in-http-header-parsing","title":"Apache Traffic Server out-of-bounds write in HTTP header parsing","severity":"high","exploited":false,"published_at":"2026-07-29T09:16:29.743+00:00","url":"https://junglewise.ai/threats/cve-2026-58154-apache-traffic-server-out-of-bounds-write-in-http-header-parsing"},{"cve":"CVE-2026-58157","cvss":8.7,"slug":"cve-2026-58157-apache-traffic-server-session-and-tunnel-reuse-data-exposure","title":"Apache Traffic Server session and tunnel reuse data exposure","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:41.173+00:00","url":"https://junglewise.ai/threats/cve-2026-58157-apache-traffic-server-session-and-tunnel-reuse-data-exposure"},{"cve":"CVE-2026-58182","cvss":8.6,"slug":"cve-2026-58182-apache-traffic-server-state-mishandling-in-ts-lua-plugin","title":"Apache Traffic Server state mishandling in ts_lua plugin","severity":"high","exploited":false,"published_at":"2026-07-29T10:16:43.23+00:00","url":"https://junglewise.ai/threats/cve-2026-58182-apache-traffic-server-state-mishandling-in-ts-lua-plugin"},{"cve":"CVE-2026-58153","cvss":8.3,"slug":"cve-2026-58153-apache-traffic-server-http-smuggling-via-improper-http-2-to-http","title":"Apache Traffic Server HTTP smuggling via improper HTTP/2 to HTTP/1 framing","severity":"high","exploited":false,"published_at":"2026-07-29T09:16:29.613+00:00","url":"https://junglewise.ai/threats/cve-2026-58153-apache-traffic-server-http-smuggling-via-improper-http-2-to-http"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}