These vulnerabilities were identified through the Apache Traffic Server security
process and an independent security audit of the code base. We thank all reporters,
credited per advisory below. To report a security issue, email
security@trafficserver.apache.org;
please do not open public issues for security matters. See also the
ASF security policy.
Hop-by-hop and internal headers from untrusted peers are not stripped
Apache Traffic Server does not strip Connection-listed hop-by-hop or internal @ headers from untrusted peers before plugin hooks, enabling request smuggling and metadata injection.
- Component
- HTTP/1
- Type
- Request smuggling
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Charlie Campbell, Brian Neradt, Apache Community
HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling.
- Component
- HTTP/2
- Type
- Request smuggling
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community
Header-name length truncation enables header aliasing and request smuggling
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass.
- Component
- Header parsing
- Type
- Request smuggling
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
Memory-safety errors in MIME and header parsing
Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers.
- Component
- Header parsing (MIME)
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Michael Bommarito, Apache Community, Omkhar Arasaratnam
Improper server-session reuse can expose data across client connections
Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections.
- Component
- HTTP state machine
- Type
- Information disclosure
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community, Omkhar Arasaratnam
Unanchored regular-expression matching allows ACL and policy bypass
Apache Traffic Server uses unanchored regular expressions for selection, so substring and suffix matches bypass ACL, SNI, signature, and geo controls across remap and several plugins.
- Component
- Remap / SNI / plugins
- Type
- Access-control bypass
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
Memory-safety and path-traversal errors in the Cripts framework
The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors.
- Component
- Cripts
- Type
- Memory safetyPath traversal
- Fixed in
- 10.1.4
- Reported by
- Apache Community, Omkhar Arasaratnam
Abusive HTTP/2 framing can exhaust resources and crash the server
Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control.
- Component
- HTTP/2
- Type
- Denial of service
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community, Omkhar Arasaratnam
Memory-safety errors in TLS and SNI handling can crash the server
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.
- Component
- TLS/SNI
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
Malformed chunked message body allows request smuggling
Apache Traffic Server allows request smuggling if chunked messages are malformed.
- Component
- HTTP/1
- Type
- Request smuggling
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Haruki Oyama, Katsutoshi Ikenoya (LY Corporation), Apache Community
Certifier plugin trusts client SNI when generating certificates
The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.
- Component
- Plugin: certifier
- Type
- Spoofing / cert trust
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
SNI and Host comparison uses a one-sided length, allowing host-SNI policy bypass
Apache Traffic Server compares the TLS SNI against the Host header with a length taken from the Host alone, so any SNI that has the Host as a prefix bypasses host-SNI policy.
- Component
- TLS/SNI
- Type
- Access-control bypass
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- JD Marsters (Bhut Red), Apache Community
ts_lua plugin has initialization and resource-handling errors
The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state.
- Component
- Plugin: ts_lua
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
HTTP/2 and HTTP/3 to HTTP/1 conversion can leak framing and trailers to clients
Apache Traffic Server can lose per-stream framing and forward origin trailers when converting HTTP/2 or HTTP/3 to HTTP/1, enabling smuggling.
- Component
- HTTP/2 · HTTP/3 → HTTP/1
- Type
- Request smuggling
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community, Omkhar Arasaratnam
Listener and ACL handling allow access-control bypass
Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors.
- Component
- Remap/ACL
- Type
- Access-control bypass
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community, Omkhar Arasaratnam
header_rewrite plugin cookie handling can corrupt memory
The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations.
- Component
- Plugin: header_rewrite
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
Memory-safety and limit-bypass errors across experimental plugins
Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.
- Component
- Plugins (experimental)
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Yon Harlicaj, Apache Community, Omkhar Arasaratnam
regex_remap plugin overflows the stack from attacker input
The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input.
- Component
- Plugin: regex_remap
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community
Cache deserialization and lifetime errors can corrupt state or crash the server
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.
- Component
- Cache
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community, Omkhar Arasaratnam
Remap configuration lifetime and TOCTOU errors cause use-after-free
Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling.
- Component
- Remap config
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community, Omkhar Arasaratnam
HostDB SRV handling leaks memory
Apache Traffic Server leaks memory when handling HostDB SRV records.
- Component
- HostDB
- Type
- Denial of service
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
ESI plugin allows uncontrolled recursion and server-side request forgery
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.
- Component
- Plugin: ESI
- Type
- SSRFDenial of service
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community
txn_box plugin overflows the stack from attacker input
The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input.
- Component
- Plugin: txn_box
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community
uri_signing and url_sig plugins can exhaust the stack or crash
The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input.
- Component
- Plugin: uri_signing / url_sig
- Type
- Denial of service
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community, Omkhar Arasaratnam
webp_transform plugin decodes unsafely and mislabels degraded responses
The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses.
- Component
- Plugin: webp_transform
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
Plugins resetting the redirect counter enable SSRF amplification
Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.
- Component
- HTTP state machine
- Type
- SSRF
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
Chunked extension quoted-string parsing allows request smuggling
Apache Traffic Server terminates a chunked-extension quoted-string at CRLF, so a smuggled request hidden in the quoted value is parsed as a second request when ATS is a reverse proxy.
- Component
- HTTP/1
- Type
- Request smuggling
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Rajat Raghav, Katsutoshi Ikenoya (LY Corporation)
Out-of-bounds reads while parsing DNS responses
Apache Traffic Server reads out of bounds while parsing DNS answers.
- Component
- DNS
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community, Omkhar Arasaratnam
Integer-handling errors in HPACK/XPACK decoding corrupt memory
Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory.
- Component
- HPACK/XPACK
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community
PROXY protocol parsing has port truncation and a stack overflow
Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack.
- Component
- PROXY protocol
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community
prefetch plugin can crash on attacker-influenced input
The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input.
- Component
- Plugin: prefetch
- Type
- Denial of service
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
Use-after-free in the intercept plugin
The Apache Traffic Server intercept plugin has a use-after-free.
- Component
- Plugin: intercept
- Type
- Memory safety
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
URL and port parsing errors allow access-control bypass
Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass.
- Component
- URL parsing
- Type
- Access-control bypass
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Apache Community, Omkhar Arasaratnam
Multiplexer plugin chunk decoder enables a denial of service
The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.
- Component
- Plugin: multiplexer
- Type
- Denial of service
- Fixed in
- 9.2.15 / 10.1.4
- Reported by
- Omkhar Arasaratnam
