Apache Software Foundation Apache Traffic Server

Name: Apache Software Foundation Apache Traffic Server
Brand: Apache Software Foundation

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

8critical38high7medium0low

updated 2026-10-28

vulnerabilities (95)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2018-8004US	medium6.5	6.31% (94th)	Exploit	no fix	2018-08-29	2 versions
CVE-2026-33267US	critical9.1	0.60% (49th)	Exploit	no fix	2026-07-29	2 versions
CVE-2024-31309US	—	94.6% (100th)	—	no fix	2024-04-10	2 versions
CVE-2023-39456US	high7.5	58.3% (99th)	—	no fix	2023-10-17	≤ 9.0.0 ≤9.2.2
CVE-2018-1318US	high7.5	7.72% (95th)	—	no fix	2018-08-29	2 versions
CVE-2018-8022US	high7.5	7.50% (94th)	—	no fix	2018-08-29	≤ 6.2.2
CVE-2018-8040US	medium5.3	7.17% (94th)	—	no fix	2018-08-29	2 versions
CVE-2018-8005US	medium5.3	6.89% (94th)	—	no fix	2018-08-29	2 versions
CVE-2020-9494US	high7.5	3.58% (89th)	—	no fix	2020-06-24	3 versions
CVE-2021-27577US	high7.5	3.45% (89th)	—	no fix	2021-06-29	≤ Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1
CVE-2017-5659US	high7.5	2.96% (87th)	—	no fix	2017-04-17	≤ All versions prior to version 6.2.1
CVE-2016-5396US	high7.5	2.88% (87th)	—	no fix	2017-04-17	≤ 6.0.0 to 6.2.0
CVE-2021-35474US	critical9.8	2.71% (86th)	—	no fix	2021-06-30	≤ Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1
CVE-2021-37149US	high7.5	2.70% (86th)	—	no fix	2021-11-03	≤ 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0
CVE-2021-37148US	high7.5	2.70% (86th)	—	no fix	2021-11-03	≤ 8.0.0 to 8.1.2 and 9.0.0 to 9.0.1
CVE-2021-37147US	high7.5	2.52% (85th)	—	no fix	2021-11-03	≤ 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0
CVE-2021-41585US	high7.5	2.49% (85th)	—	no fix	2021-11-03	≤ 7.0.0 to 9.1.0
CVE-2022-31779US	high7.5	2.48% (85th)	—	no fix	2022-08-10	≤ 8.0.0 to 9.1.2
CVE-2022-31780US	high7.5	2.48% (85th)	—	no fix	2022-08-10	≤ 8.0.0 to 9.1.2
CVE-2022-28129US	high7.5	2.48% (85th)	—	no fix	2022-08-10	≤ 8.0.0 to 9.1.2
CVE-2021-32567US	high7.5	2.45% (84th)	—	no fix	2021-06-30	≤ Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1
CVE-2021-32566US	high7.5	2.45% (84th)	—	no fix	2021-06-30	≤ Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1
CVE-2021-43082US	critical9.8	2.41% (84th)	—	no fix	2021-11-03	≤ 9.1.0
CVE-2021-37150US	high7.5	2.25% (83rd)	—	no fix	2022-08-10	≤ 8.0.0 to 9.1.2
CVE-2017-7671US	high7.5	2.19% (82nd)	—	no fix	2018-02-27	3 versions
CVE-2022-31778US	high7.5	2.14% (82nd)	—	no fix	2022-08-10	≤ 8.0.0 to 9.0.2
CVE-2021-32565US	high7.5	2.14% (82nd)	—	no fix	2021-06-29	≤ Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1
CVE-2022-25763US	high7.5	2.09% (82nd)	—	no fix	2022-08-10	≤ 8.0.0 to 9.1.2
CVE-2023-30631US	high7.5	2.00% (81st)	—	no fix	2023-06-14	≤ 8.0.0 ≤9.2.0
CVE-2022-47185US	high7.5	2.00% (81st)	—	no fix	2023-08-09	≤ 0 ≤9.2.1
CVE-2021-44040US	high7.5	1.99% (81st)	—	no fix	2022-03-23	≤ 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1
CVE-2021-38161US	high8.1	1.95% (80th)	—	no fix	2021-11-03	≤ 8.0.0 to 8.0.8
CVE-2017-5660US	high8.6	1.93% (80th)	—	no fix	2018-02-27	2 versions
CVE-2018-11783US	high7.5	1.87% (79th)	—	no fix	2019-03-07	≤ Apache Traffic Server 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, 8.0.0 to 8.0.1
CVE-2023-41752US	high7.5	1.63% (76th)	—	no fix	2023-10-17	2 versions
CVE-2021-44759US	high8.1	1.58% (75th)	—	no fix	2022-03-23	≤ 8.0.0 to 8.1.0
CVE-2024-50306US	—	1.57% (75th)	—	no fix	2024-11-14	2 versions
CVE-2023-33934US	critical9.1	1.56% (75th)	—	no fix	2023-08-09	≤ 0 ≤9.2.1
CVE-2023-33933US	high7.5	1.51% (74th)	—	no fix	2023-06-14	≤ 8.0.0 ≤9.2.0
CVE-2022-47184US	high7.5	1.50% (74th)	—	no fix	2023-06-14	≤ 8.0.0 ≤9.2.0
CVE-2022-32749US	high7.5	1.39% (72nd)	—	no fix	2022-12-19	≤ 8.0.0 ≤9.1.3
CVE-2022-37392US	medium5.3	1.18% (67th)	—	no fix	2022-12-19	≤ 8.0.0 ≤9.1.3
CVE-2022-40743US	medium6.1	1.15% (67th)	—	no fix	2022-12-19	≤ 9.0.0 ≤9.1.3
CVE-2024-35296US	high8.2	1.08% (65th)	—	no fix	2024-07-26	2 versions
CVE-2023-38522US	high7.5	0.99% (62nd)	—	no fix	2024-07-26	2 versions
CVE-2024-35161US	high7.5	0.97% (62nd)	—	no fix	2024-07-26	2 versions
CVE-2024-50305US	—	0.93% (60th)	—	no fix	2024-11-14	≤ 9.2.0 ≤9.2.5
CVE-2024-38311US	—	0.91% (60th)	—	no fix	2025-03-06	3 versions
CVE-2024-56202US	—	0.87% (59th)	—	no fix	2025-03-06	2 versions
CVE-2024-38479US	—	0.82% (57th)	—	no fix	2024-11-14	2 versions

showing 50 of 95

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation31 CVEs
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')17 CVEs
CWE-400Uncontrolled Resource Consumption7 CVEs
CWE-121Stack-based Buffer Overflow6 CVEs
CWE-787Out-of-bounds Write6 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor5 CVEs
CWE-284Improper Access Control4 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')2 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)95 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan