# Apache Traffic Server vulnerabilities Source: https://junglewise.ai/threats/technologies/traffic-server Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/traffic-server.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 55 vulnerabilities in Apache Traffic Server: 0 in the last 7 days and 16 in the last 90 days, 14 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112381, was published on 21 October 2026. 15 vulnerabilities in the last four weeks, up 1400% on the four before (1). 7 critical against 1. ## Counts - Last 7 days: 0 - Last 30 days: 15 - Last 90 days: 16 - All time: 55 (14 critical, 0 exploited in the wild) ## About Apache Traffic Server Apache reverse proxy and HTTP caching server. ## Latest Apache Traffic Server vulnerabilities - [CVE-2026-112381: Apache Traffic Server null pointer dereference in request tear-down](https://junglewise.ai/threats/cve-2026-112381-apache-traffic-server-can-crash-with-a-null-pointer-dereference) (medium, CVSS 5.9, published 21 Oct 2026) - [CVE-2026-111817: Apache Traffic Server connection stall with chunked transfer trailers dropped](https://junglewise.ai/threats/cve-2026-111817-apache-traffic-server-can-stall-a-chunked-transfer-that-it) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-111815: Apache Traffic Server TLS session resumption bypass of client certificate verification](https://junglewise.ai/threats/cve-2026-111815-apache-traffic-server-can-resume-a-tls-session-across-sni) (critical, CVSS 10, published 21 Oct 2026) - [CVE-2026-111814: Apache Traffic Server TLS session reuse with mismatched client certificates](https://junglewise.ai/threats/cve-2026-111814-apache-traffic-server-s-default-outbound-session-sharing-policy) (critical, CVSS 10, published 21 Oct 2026) - [CVE-2026-111812: Apache Traffic Server origin_server_auth AWS request signing bypass](https://junglewise.ai/threats/cve-2026-111812-apache-traffic-server-s-origin-server-auth-plugin-lets-a-client) (critical, CVSS 10, published 21 Oct 2026) - [CVE-2026-111811: Apache Traffic Server tsmemcache plugin unauthenticated cache access](https://junglewise.ai/threats/cve-2026-111811-apache-traffic-server-s-experimental-tsmemcache-plugin-allows) (critical, CVSS 9, published 21 Oct 2026) - [CVE-2026-111810: Apache Traffic Server unthrottled logging on header stripping](https://junglewise.ai/threats/cve-2026-111810-apache-traffic-server-9-2-15-10-1-4-and-10-2-0-write-one) (high, CVSS 7.5, published 21 Oct 2026) - [CVE-2026-111809: Apache Traffic Server request smuggling via HEAD requests](https://junglewise.ai/threats/cve-2026-111809-apache-traffic-server-allows-request-smuggling-via-head-requests) (critical, CVSS 9.3, published 21 Oct 2026) - [CVE-2026-111808: Apache Traffic Server worker pool exhaustion via malformed HTTP/2 DATA frame](https://junglewise.ai/threats/cve-2026-111808-apache-traffic-server-can-be-used-to-exhaust-an-http-1-1-origin) (high, CVSS 8.6, published 21 Oct 2026) - [CVE-2026-111805: Apache Traffic Server HTTP/2 request smuggling via truncated Content-Length](https://junglewise.ai/threats/cve-2026-111805-apache-traffic-server-can-be-used-to-exhaust-an-http-1-1-origin) (high, CVSS 8.6, published 21 Oct 2026) - [CVE-2026-111816: Apache Traffic Server malformed response cache poisoning](https://junglewise.ai/threats/cve-2026-111816-apache-traffic-server-forwarded-a-malformed-302-response-that) (critical, CVSS 9.3, published 21 Oct 2026) - [CVE-2026-111813: Apache Traffic Server command injection in magick plugin](https://junglewise.ai/threats/cve-2026-111813-apache-traffic-server-s-experimental-magick-plugin-lets-an) (critical, CVSS 10, published 21 Oct 2026) - [CVE-2026-111804: Apache Traffic Server use-after-free and metric ID validation bypass in wasm plugin](https://junglewise.ai/threats/cve-2026-111804-apache-traffic-server-s-experimental-wasm-plugin-has-a-use-after) (high, CVSS 8.2, published 21 Oct 2026) - [CVE-2025-55702: Apache Traffic Server HTTP request smuggling via Expect: 100-continue](https://junglewise.ai/threats/cve-2025-55702-when-a-client-sends-a-post-with-expect-100-continue-and-the) (high, CVSS 8.7, published 21 Oct 2026) - [CVE-2025-31699: Apache Traffic Server HTTP request smuggling via incomplete request bodies](https://junglewise.ai/threats/cve-2025-31699-apache-traffic-server-can-return-an-origin-connection-to-the) (high, CVSS 8.9, published 21 Oct 2026) - [CVE-2026-102795: Apache Traffic Server improper access control](https://junglewise.ai/threats/cve-2026-102795-improper-access-control-vulnerability-in-apache-traffic-server) (critical, CVSS 9.3, published 2 Oct 2026) - [CVE-2026-65100: Apache Traffic Server HTTP/2 HPACK dynamic table corruption](https://junglewise.ai/threats/cve-2026-65100-apache-traffic-server-http-2-hpack-dynamic-table-corruption) (medium, CVSS 4.8, published 29 Jul 2026) - [CVE-2026-58189: Apache Traffic Server SSRF amplification via redirect-limit bypass](https://junglewise.ai/threats/cve-2026-58189-apache-traffic-server-ssrf-amplification-via-redirect-limit) (high, CVSS 7.5, published 29 Jul 2026) - [CVE-2026-58188: Apache Traffic Server memory safety and limit bypass in experimental plugins](https://junglewise.ai/threats/cve-2026-58188-apache-traffic-server-memory-safety-and-limit-bypass-in) (high, CVSS 8.2, published 29 Jul 2026) - [CVE-2026-58187: Apache Traffic Server out-of-bounds write in multiplexer plugin](https://junglewise.ai/threats/cve-2026-58187-apache-traffic-server-out-of-bounds-write-in-multiplexer-plugin) (low, CVSS 3.7, published 29 Jul 2026) - [CVE-2026-58186: Apache Traffic Server unsafe decoding in webp_transform plugin](https://junglewise.ai/threats/cve-2026-58186-apache-traffic-server-unsafe-decoding-in-webp-transform-plugin) (high, CVSS 7.5, published 29 Jul 2026) - [CVE-2026-58184: Apache Traffic Server memory corruption in header_rewrite plugin](https://junglewise.ai/threats/cve-2026-58184-apache-traffic-server-memory-corruption-in-header-rewrite-plugin) (high, CVSS 8.2, published 29 Jul 2026) - [CVE-2026-58183: Apache Traffic Server denial of service in prefetch plugin](https://junglewise.ai/threats/cve-2026-58183-apache-traffic-server-denial-of-service-in-prefetch-plugin) (medium, CVSS 5.9, published 29 Jul 2026) - [CVE-2026-58182: Apache Traffic Server state mishandling in ts_lua plugin](https://junglewise.ai/threats/cve-2026-58182-apache-traffic-server-state-mishandling-in-ts-lua-plugin) (high, CVSS 8.6, published 29 Jul 2026) - [CVE-2026-58181: Apache Traffic Server stack exhaustion in uri_signing and url_sig plugins](https://junglewise.ai/threats/cve-2026-58181-apache-traffic-server-stack-exhaustion-in-uri-signing-and-url-sig) (high, CVSS 7.5, published 29 Jul 2026) ## Most severe Apache Traffic Server vulnerabilities - [CVE-2026-111815: Apache Traffic Server TLS session resumption bypass of client certificate verification](https://junglewise.ai/threats/cve-2026-111815-apache-traffic-server-can-resume-a-tls-session-across-sni) (critical, CVSS 10, published 21 Oct 2026) - [CVE-2026-111814: Apache Traffic Server TLS session reuse with mismatched client certificates](https://junglewise.ai/threats/cve-2026-111814-apache-traffic-server-s-default-outbound-session-sharing-policy) (critical, CVSS 10, published 21 Oct 2026) - [CVE-2026-111812: Apache Traffic Server origin_server_auth AWS request signing bypass](https://junglewise.ai/threats/cve-2026-111812-apache-traffic-server-s-origin-server-auth-plugin-lets-a-client) (critical, CVSS 10, published 21 Oct 2026) - [CVE-2026-111813: Apache Traffic Server command injection in magick plugin](https://junglewise.ai/threats/cve-2026-111813-apache-traffic-server-s-experimental-magick-plugin-lets-an) (critical, CVSS 10, published 21 Oct 2026) - [CVE-2026-58162: Apache Traffic Server improper certificate validation in certifier plugin](https://junglewise.ai/threats/cve-2026-58162-apache-traffic-server-improper-certificate-validation-in) (critical, CVSS 10, published 29 Jul 2026) - [CVE-2026-58150: Apache Traffic Server request smuggling in HTTP/2 downgrade](https://junglewise.ai/threats/cve-2026-58150-apache-traffic-server-request-smuggling-in-http-2-downgrade) (critical, CVSS 10, published 29 Jul 2026) - [CVE-2026-57834: Apache Traffic Server request smuggling via malformed chunked messages](https://junglewise.ai/threats/cve-2026-57834-apache-traffic-server-request-smuggling-via-malformed-chunked) (critical, CVSS 10, published 29 Jul 2026) - [CVE-2026-33267: Apache Traffic Server improper input validation](https://junglewise.ai/threats/cve-2026-33267-apache-traffic-server-improper-input-validation) (critical, CVSS 10, published 29 Jul 2026) - [CVE-2026-102795: Apache Traffic Server improper access control](https://junglewise.ai/threats/cve-2026-102795-improper-access-control-vulnerability-in-apache-traffic-server) (critical, CVSS 9.3, published 2 Oct 2026) - [CVE-2026-111809: Apache Traffic Server request smuggling via HEAD requests](https://junglewise.ai/threats/cve-2026-111809-apache-traffic-server-allows-request-smuggling-via-head-requests) (critical, CVSS 9.3, published 21 Oct 2026) ## Vulnerabilities per week 15 vulnerabilities in the last four weeks, up 1400% on the four before (1). 7 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 1 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 15 | 7 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Apache technologies - [Apache Airflow](https://junglewise.ai/threats/technologies/airflow): 95 vulnerabilities - [Apache Camel](https://junglewise.ai/threats/technologies/camel): 87 vulnerabilities - [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat): 87 vulnerabilities - [Apache Thrift](https://junglewise.ai/threats/technologies/thrift): 77 vulnerabilities - [Apache Ofbiz](https://junglewise.ai/threats/technologies/ofbiz): 67 vulnerabilities - [Apache HTTP Server](https://junglewise.ai/threats/technologies/http-server): 62 vulnerabilities - [Apache Brpc](https://junglewise.ai/threats/technologies/brpc): 36 vulnerabilities - [Apache Roller](https://junglewise.ai/threats/technologies/roller): 30 vulnerabilities - [Apache CloudStack](https://junglewise.ai/threats/technologies/cloudstack): 28 vulnerabilities - [Apache ActiveMQ](https://junglewise.ai/threats/technologies/activemq): 27 vulnerabilities - [Apache Apisix](https://junglewise.ai/threats/technologies/apisix): 27 vulnerabilities - [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket): 23 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Apache Traffic Server vulnerabilities", https://junglewise.ai/threats/technologies/traffic-server, 12 November 2026.