DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Apache Traffic Server: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-07-28
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, einen Denial-of-Service auszulösen und potentiell eine Codeausführung zu erreichen.
01
beschreibt (38)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-65100US | — | — | ||
Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the p… | ||||
| CVE-2026-58189US | — | — | ||
Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification.
This issue affects Apache Traffic Server: from 8.0.0 through… | ||||
| CVE-2026-58188US | — | — | ||
Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 th… | ||||
| CVE-2026-58187US | high7.5 | — | ||
The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service.
This issue affects Apache Traffic Server: from 8.0.0… | ||||
| CVE-2026-58186US | — | — | ||
The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.1… | ||||
| CVE-2026-58185US | critical9.8 | — | ||
The Apache Traffic Server intercept plugin has a use-after-free.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through… | ||||
| CVE-2026-58184US | high7.5 | — | ||
The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching.
This issue affects Apache Traffic Server: from 8.… | ||||
| CVE-2026-58183US | high7.5 | — | ||
The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 throu… | ||||
| CVE-2026-58182US | — | — | ||
The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, f… | ||||
| CVE-2026-58181US | — | — | ||
The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, fro… | ||||
| CVE-2026-58180US | — | — | ||
The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through… | ||||
| CVE-2026-58179US | critical9.8 | — | ||
The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0… | ||||
| CVE-2026-58178US | — | — | ||
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 t… | ||||
| CVE-2026-58177US | critical9.8 | — | ||
The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors.
This issue affects Apache Traffic Server: from 10.0.0 through 10.1.… | ||||
| CVE-2026-58175US | — | — | ||
Apache Traffic Server leaks memory when handling HostDB SRV records.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 thr… | ||||
| CVE-2026-58164US | — | — | ||
Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9,… | ||||
| CVE-2026-58163US | critical9.1 | — | ||
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, fr… | ||||
| CVE-2026-58162US | — | — | ||
The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from… | ||||
| CVE-2026-58161US | — | — | ||
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.… | ||||
| CVE-2026-58160US | — | — | ||
Apache Traffic Server reads out of bounds while parsing DNS answers.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0… | ||||
20 von 38 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Apache Traffic Server vulnerabilities vom 2026-07-28external
- WID-SEC-W-2026-2561 - CSAF Versionself
- WID-SEC-2026-2561 - Portal Versionself
- CVE Record vom 2026-07-28external
- CVE Record vom 2026-07-28external
- CVE Record vom 2026-07-28external
- CVE Record vom 2026-07-28external
- CVE Record vom 2026-07-28external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan