How many Apache Software Foundation traffic server CVEs are in CISA KEV?

Yes — 1 of Apache Software Foundation traffic server's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for Apache Software Foundation traffic server vulnerabilities?

Yes — 1 of Apache Software Foundation traffic server's CVEs have a known public exploit.

Which versions of Apache Software Foundation traffic server are affected?

149 distinct Apache Software Foundation traffic server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Apache Software Foundation traffic server CVEs?

Apache Software Foundation traffic server's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

What is the average severity of Apache Software Foundation traffic server CVEs?

The average CVSS base score across Apache Software Foundation traffic server's scored CVEs is 7.6.

Apache Software Foundation traffic server Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Apache Software Foundation traffic server vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Overview

Apache Software Foundation traffic server has 81 published CVE records since 2010, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 1 have a known public exploit. The average CVSS base score across scored CVEs is 7.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Apache Software Foundation traffic server, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Apache Software Foundation traffic server's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical13

High55

Medium13

Low0

In CISA’s Known Exploited Vulnerabilities catalog

1

One of Apache Software Foundation traffic server's CVEs is confirmed exploited in the wild.

Public exploits

1

One of Apache Software Foundation traffic server's CVEs has a known public exploit available.

Affected versions and CVEs

Browse every Apache Software Foundation traffic server version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

6.0.0 <= v <= 6.2.316 CVEs
7.0.0 <= v <= 7.1.68 CVEs
8.0.0 <= v <= 8.0.38 CVEs
9.0.0 <= v <= 9.0.16 CVEs
6.0.0 <= v <= 6.2.25 CVEs
7.0.0 <= v <= 7.1.125 CVEs
8.0.0 <= v <= 8.1.15 CVEs
8.0.0 <= v <= 8.1.25 CVEs
8.0.0 <= v <= 8.1.45 CVEs
9.0.0 <= v <= 9.1.25 CVEs
10.0.0 <= v < 10.0.44 CVEs
7.0.0 <= v <= 7.1.34 CVEs
9.0.0 <= v <= 9.1.04 CVEs
5.3.0 <= v <= 5.3.03 CVEs
7.0.0 <= v <= 7.1.83 CVEs
8.0.0 <= v < 8.1.113 CVEs
8.0.0 <= v < 8.1.73 CVEs
8.0.0 <= v <= 8.0.53 CVEs
9.0.0 <= v < 9.2.13 CVEs
9.0.0 <= v < 9.2.33 CVEs
9.0.0 <= v < 9.2.53 CVEs
9.0.0 <= v < 9.2.63 CVEs
9.0.0 <= v < 9.2.93 CVEs
<= 6.2.02 CVEs
10.0.0 <= v < 10.0.62 CVEs
10.0.0 <= v < 10.1.22 CVEs
2.1.0 <= v <= 2.1.02 CVEs
2.1.1 <= v <= 2.1.12 CVEs
5.3.1 <= v <= 5.3.12 CVEs
7.0.0 <= v <= 7.0.02 CVEs
7.0.0 <= v <= 7.1.102 CVEs
8.0.0 <= v < 8.1.62 CVEs
8.0.0 <= v < 8.1.92 CVEs
8.0.0 <= v <= 8.0.72 CVEs
8.0.0 <= v <= 8.1.02 CVEs
8.0.0 <= v <= 8.1.102 CVEs
8.0.0 <= v <= 8.1.62 CVEs
8.0.0 <= v <= 8.1.72 CVEs
9.0.0 <= v < 9.1.42 CVEs
9.0.0 <= v < 9.2.112 CVEs
9.0.0 <= v < 9.2.132 CVEs
9.0.0 <= v <= 9.2.02 CVEs
9.0.0 <= v <= 9.2.12 CVEs
9.0.0 <= v <= 9.2.42 CVEs
< 7.1.71 CVE
<= 2.0.01 CVE
<= 5.1.11 CVE
<= 9.2.21 CVE
10.0.0 <= v < 10.0.21 CVE
10.0.0 <= v < 10.0.51 CVE
2.0.0 <= v <= 2.0.01 CVE
2.0.1 <= v <= 2.0.11 CVE
2.1.2 <= v <= 2.1.21 CVE
2.1.3 <= v <= 2.1.31 CVE
2.1.4 <= v <= 2.1.41 CVE
2.1.5 <= v <= 2.1.51 CVE
2.1.6 <= v <= 2.1.61 CVE
2.1.7 <= v <= 2.1.71 CVE
2.1.8 <= v <= 2.1.81 CVE
2.1.9 <= v <= 2.1.91 CVE
3.0.0 <= v <= 3.0.01 CVE
3.0.1 <= v <= 3.0.11 CVE
3.0.2 <= v <= 3.0.21 CVE
3.0.3 <= v <= 3.0.31 CVE
3.0.4 <= v <= 3.0.41 CVE
3.1.0 <= v <= 3.1.01 CVE
3.1.1 <= v <= 3.1.11 CVE
3.1.2 <= v <= 3.1.21 CVE
3.1.3 <= v <= 3.1.31 CVE
3.1.4 <= v <= 3.1.41 CVE
3.2.0 <= v <= 3.2.01 CVE
3.3.0 <= v <= 3.3.01 CVE
3.3.1 <= v <= 3.3.11 CVE
3.3.2 <= v <= 3.3.21 CVE
3.3.3 <= v <= 3.3.31 CVE
3.3.4 <= v <= 3.3.41 CVE
3.3.5 <= v <= 3.3.51 CVE
4.0.1 <= v <= 4.0.11 CVE
4.1.0 <= v <= 4.1.01 CVE
4.2.0 <= v <= 4.2.01 CVE
4.2.1 <= v <= 4.2.11 CVE
5.0.0 <= v <= 5.0.01 CVE
5.1.0 <= v <= 5.1.01 CVE
5.2.0 <= v <= 5.3.21 CVE
6.0.0 <= v <= 6.0.01 CVE
6.0.0 <= v <= 6.0.31 CVE
6.0.0 <= v <= 6.2.01 CVE
6.1.0 <= v <= 6.1.01 CVE
6.1.1 <= v <= 6.1.11 CVE
6.2.0 <= v <= 6.2.01 CVE
6.2.1 <= v <= 6.2.11 CVE
6.2.2 <= v <= 6.2.21 CVE
7.0.0 <= v < 7.1.101 CVE
7.0.0 <= v <= 7.1.111 CVE
7.0.0 <= v <= 7.1.51 CVE
7.0.0 <= v <= 7.1.91 CVE
8.0.0 <= v < 8.0.41 CVE
8.0.0 <= v < 8.0.71 CVE
8.0.0 <= v < 8.1.101 CVE
8.0.0 <= v < 8.1.51 CVE
8.0.0 <= v <= 8.0.11 CVE
8.0.0 <= v <= 8.0.61 CVE
8.0.0 <= v <= 8.0.81 CVE
8.0.0 <= v <= 8.1.111 CVE
8.0.0 <= v <= 8.1.31 CVE
8.0.0 <= v <= 8.1.51 CVE
8.0.0 <= v <= 8.1.91 CVE
9.0.0 <= v < 9.1.31 CVE
9.0.0 <= v < 9.2.101 CVE
9.0.0 <= v < 9.2.41 CVE
9.0.0 <= v <= 9.0.01 CVE
9.0.0 <= v <= 9.1.11 CVE
9.0.0 <= v <= 9.1.31 CVE
9.0.0 <= v <= 9.2.31 CVE

Fixed in

10.0.44 CVEs
8.1.113 CVEs
8.1.73 CVEs
9.2.13 CVEs
9.2.33 CVEs
9.2.53 CVEs
9.2.63 CVEs
9.2.93 CVEs
> 8.1.102 CVEs
> 8.1.62 CVEs
> 8.1.72 CVEs
> 9.2.02 CVEs
> 9.2.12 CVEs
> 9.2.42 CVEs
10.0.62 CVEs
10.1.22 CVEs
8.1.62 CVEs
8.1.92 CVEs
9.1.42 CVEs
9.2.112 CVEs
9.2.132 CVEs
> 8.1.91 CVE
> 9.2.21 CVE
> 9.2.31 CVE
10.0.21 CVE
10.0.51 CVE
7.1.101 CVE
7.1.71 CVE
8.0.41 CVE
8.0.71 CVE
8.1.101 CVE
8.1.51 CVE
9.1.31 CVE
9.2.101 CVE
9.2.41 CVE

Find a version

81 CVEs

Sort

Apache Traffic Server: Malformed chunked message body allows request smuggling
CVE-2025-65114
Patch
CWE-444
High · CVSS 7.5
EPSS 0.4% (35th pct)2026-04-02
Apache Traffic Server: A simple legitimate POST request causes a crash
CVE-2025-58136
Patch
CWE-670
High · CVSS 7.5
EPSS 0.7% (48th pct)2026-04-02
Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL
CVE-2025-31698
Patch
CWE-284
High · CVSS 7.5
EPSS 0.4% (36th pct)2025-06-19
Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin
CVE-2025-49763
Patch
CWE-400
High · CVSS 7.5
EPSS 0.6% (46th pct)2025-06-19
Apache Traffic Server: Malformed chunked message body allows request smuggling
CVE-2024-53868
Patch
CWE-444
High · CVSS 7.5
EPSS 0.6% (46th pct)2025-04-03
Medium vulnerability · 2025-03-06
CVE-2024-38311
Patch
CWE-20
Medium · CVSS 6.3
EPSS 0.8% (54th pct)2025-03-06
Medium vulnerability · 2025-03-06
CVE-2024-56195
Patch
CWE-284
Medium · CVSS 6.3
EPSS 0.7% (50th pct)2025-03-06
Medium vulnerability · 2025-03-06
CVE-2024-56196
Patch
CWE-284
Medium · CVSS 6.3
EPSS 0.7% (50th pct)2025-03-06
Apache Traffic Server: Expect header field can unreasonably retain resource
CVE-2024-56202
Patch
CWE-440
Medium · CVSS 4.3
EPSS 0.8% (53th pct)2025-03-06
Medium vulnerability · 2024-11-20
CVE-2018-9481
Patch
CWE-125
Medium · CVSS 6.5
EPSS 0.1% (4th pct)2024-11-20
Apache Traffic Server: Server process can fail to drop privilege
CVE-2024-50306
Patch
CWE-252
Critical · CVSS 9.1
EPSS 1.6% (73th pct)2024-11-14
Apache Traffic Server: Valid Host field value can cause crashes
CVE-2024-50305
Patch
CWE-20
High · CVSS 7.5
EPSS 0.9% (57th pct)2024-11-14
Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack
CVE-2024-38479
Patch
CWE-20
High · CVSS 7.5
EPSS 0.9% (57th pct)2024-11-14
Apache Traffic Server: Incomplete field name check allows request smuggling
CVE-2023-38522
Patch
CWE-444
High · CVSS 7.5
EPSS 1.0% (58th pct)2024-07-26
High vulnerability · 2024-07-26
CVE-2024-35296
Patch
CWE-20
High · CVSS 8.2
EPSS 1.1% (61th pct)2024-07-26
Critical vulnerability · 2024-07-26
CVE-2024-35161
Patch
CWE-444
Critical · CVSS 9.1
EPSS 1.0% (58th pct)2024-07-26
High vulnerability · 2024-04-10
CVE-2024-31309
Patch
CWE-20
High · CVSS 7.5
EPSS 94.6% (100th pct)2024-04-10
Apache Traffic Server: Malformed http/2 frames can cause an abort
CVE-2023-39456
Patch
CWE-20
High · CVSS 7.5
EPSS 53.5% (99th pct)2023-10-17
Apache Traffic Server: s3_auth plugin problem with hash calculation
CVE-2023-41752
Patch
CWE-200
High · CVSS 7.5
EPSS 1.2% (65th pct)2023-10-17
High vulnerability · 2023-10-10
CVE-2023-44487
CISA KEV
Public exploit
Patch
CWE-400
Added to CISA KEV 2023-10-10
High · CVSS 7.5
EPSS 100.0% (100th pct)2023-10-10
Critical vulnerability · 2023-08-09
CVE-2023-33934
Patch
CWE-444
Critical · CVSS 9.1
EPSS 1.1% (61th pct)2023-08-09
Apache Traffic Server: Invalid Range header causes a crash
CVE-2022-47185
Patch
CWE-20
High · CVSS 7.5
EPSS 1.5% (71th pct)2023-08-09
High vulnerability · 2023-06-14
CVE-2023-30631
Patch
CWE-20
High · CVSS 7.5
EPSS 2.0% (78th pct)2023-06-14
High vulnerability · 2023-06-14
CVE-2023-33933
Patch
CWE-200
High · CVSS 7.5
EPSS 1.5% (71th pct)2023-06-14
Apache Traffic Server: The TRACE method can be use to disclose network information
CVE-2022-47184
Patch
CWE-200
High · CVSS 7.5
EPSS 1.9% (77th pct)2023-06-14
Medium vulnerability · 2022-12-19
CVE-2022-40743
Patch
Workaround
CWE-79
Medium · CVSS 6.1
EPSS 1.1% (61th pct)2022-12-19
Medium vulnerability · 2022-12-19
CVE-2022-37392
Patch
CWE-754
Medium · CVSS 5.3
EPSS 1.1% (62th pct)2022-12-19
High vulnerability · 2022-12-19
CVE-2022-32749
Patch
CWE-754
High · CVSS 7.5
EPSS 1.3% (67th pct)2022-12-19
High vulnerability · 2022-08-10
CVE-2022-31779
Patch
CWE-20
High · CVSS 7.5
EPSS 1.9% (77th pct)2022-08-10
Improper input validation on HTTP/2 headers
CVE-2022-25763
Patch
CWE-444
High · CVSS 7.5
EPSS 1.6% (73th pct)2022-08-10

Showing 30 of 81

Common weakness types

The CWE weakness categories most often found in Apache Software Foundation traffic server CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Apache Software Foundation traffic server CVEs were published each year.

2014

1

2015

1

2017

6

2018

7

2019

10

2020

5

2021

14

2022

11

2023

8

2024

8

2025

7

2026

2

Other Apache Software Foundation products

Browse vulnerabilities for other products by Apache Software Foundation.

http server342 CVEs tomcat251 CVEs airflow181 CVEs Apache Airflow136 CVEs Apache HTTP Server125 CVEs httpd125 CVEs Apache Tomcat113 CVEs struts86 CVEs

All Apache Software Foundation vulnerabilities

Frequently asked questions

Common questions about Apache Software Foundation traffic server vulnerabilities.

How many CVEs does Apache Software Foundation traffic server have?: Apache Software Foundation traffic server has 81 published CVE records since 2010.
How many Apache Software Foundation traffic server CVEs are in CISA KEV?: Yes — 1 of Apache Software Foundation traffic server's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Apache Software Foundation traffic server vulnerabilities?: Yes — 1 of Apache Software Foundation traffic server's CVEs have a known public exploit.
Which versions of Apache Software Foundation traffic server are affected?: 149 distinct Apache Software Foundation traffic server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Apache Software Foundation traffic server CVEs?: Apache Software Foundation traffic server's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
How many critical Apache Software Foundation traffic server vulnerabilities are there?: Apache Software Foundation traffic server has 13 critical and 55 high-severity CVEs.
What is the average severity of Apache Software Foundation traffic server CVEs?: The average CVSS base score across Apache Software Foundation traffic server's scored CVEs is 7.6.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.