How many CVEs does Apache Software Foundation traffic server have?

Apache Software Foundation traffic server has 82 published CVE records since 2010.

How many Apache Software Foundation traffic server CVEs are in CISA KEV?

Yes — 1 of Apache Software Foundation traffic server's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for Apache Software Foundation traffic server vulnerabilities?

Yes — 2 of Apache Software Foundation traffic server's CVEs have a known public exploit.

Which versions of Apache Software Foundation traffic server are affected?

149 distinct Apache Software Foundation traffic server versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Apache Software Foundation traffic server CVEs?

Apache Software Foundation traffic server's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

What is the average severity of Apache Software Foundation traffic server CVEs?

The average CVSS base score across Apache Software Foundation traffic server's scored CVEs is 7.5.

Apache Software Foundation traffic server Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every Apache Software Foundation traffic server version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

6.0.0 <= v <= 6.2.316 CVEs
7.0.0 <= v <= 7.1.68 CVEs
8.0.0 <= v <= 8.0.38 CVEs
9.0.0 <= v <= 9.0.16 CVEs
6.0.0 <= v <= 6.2.25 CVEs
7.0.0 <= v <= 7.1.125 CVEs
8.0.0 <= v <= 8.1.15 CVEs
8.0.0 <= v <= 8.1.25 CVEs
8.0.0 <= v <= 8.1.45 CVEs
9.0.0 <= v <= 9.1.25 CVEs
10.0.0 <= v < 10.0.44 CVEs
7.0.0 <= v <= 7.1.34 CVEs
9.0.0 <= v <= 9.1.04 CVEs
2.1.0 <= v <= 2.1.03 CVEs
2.1.1 <= v <= 2.1.13 CVEs
5.3.0 <= v <= 5.3.03 CVEs
7.0.0 <= v <= 7.1.83 CVEs
8.0.0 <= v < 8.1.113 CVEs
8.0.0 <= v < 8.1.73 CVEs
8.0.0 <= v <= 8.0.53 CVEs
9.0.0 <= v < 9.2.13 CVEs
9.0.0 <= v < 9.2.33 CVEs
9.0.0 <= v < 9.2.53 CVEs
9.0.0 <= v < 9.2.63 CVEs
9.0.0 <= v < 9.2.93 CVEs
<= 6.2.02 CVEs
10.0.0 <= v < 10.0.62 CVEs
10.0.0 <= v < 10.1.22 CVEs
2.0.0 <= v <= 2.0.02 CVEs
2.0.1 <= v <= 2.0.12 CVEs
2.1.2 <= v <= 2.1.22 CVEs
2.1.3 <= v <= 2.1.32 CVEs
2.1.4 <= v <= 2.1.42 CVEs
2.1.5 <= v <= 2.1.52 CVEs
2.1.6 <= v <= 2.1.62 CVEs
2.1.7 <= v <= 2.1.72 CVEs
2.1.8 <= v <= 2.1.82 CVEs
2.1.9 <= v <= 2.1.92 CVEs
3.0.0 <= v <= 3.0.02 CVEs
3.0.1 <= v <= 3.0.12 CVEs
3.0.2 <= v <= 3.0.22 CVEs
3.0.3 <= v <= 3.0.32 CVEs
3.1.0 <= v <= 3.1.02 CVEs
3.1.1 <= v <= 3.1.12 CVEs
3.1.2 <= v <= 3.1.22 CVEs
5.3.1 <= v <= 5.3.12 CVEs
7.0.0 <= v <= 7.0.02 CVEs
7.0.0 <= v <= 7.1.102 CVEs
8.0.0 <= v < 8.1.62 CVEs
8.0.0 <= v < 8.1.92 CVEs
8.0.0 <= v <= 8.0.72 CVEs
8.0.0 <= v <= 8.1.02 CVEs
8.0.0 <= v <= 8.1.102 CVEs
8.0.0 <= v <= 8.1.62 CVEs
8.0.0 <= v <= 8.1.72 CVEs
9.0.0 <= v < 9.1.42 CVEs
9.0.0 <= v < 9.2.112 CVEs
9.0.0 <= v < 9.2.132 CVEs
9.0.0 <= v <= 9.2.02 CVEs
9.0.0 <= v <= 9.2.12 CVEs
9.0.0 <= v <= 9.2.42 CVEs
< 7.1.71 CVE
<= 2.0.01 CVE
<= 5.1.11 CVE
<= 9.2.21 CVE
10.0.0 <= v < 10.0.21 CVE
10.0.0 <= v < 10.0.51 CVE
3.0.4 <= v <= 3.0.41 CVE
3.1.3 <= v <= 3.1.31 CVE
3.1.4 <= v <= 3.1.41 CVE
3.2.0 <= v <= 3.2.01 CVE
3.3.0 <= v <= 3.3.01 CVE
3.3.1 <= v <= 3.3.11 CVE
3.3.2 <= v <= 3.3.21 CVE
3.3.3 <= v <= 3.3.31 CVE
3.3.4 <= v <= 3.3.41 CVE
3.3.5 <= v <= 3.3.51 CVE
4.0.1 <= v <= 4.0.11 CVE
4.1.0 <= v <= 4.1.01 CVE
4.2.0 <= v <= 4.2.01 CVE
4.2.1 <= v <= 4.2.11 CVE
5.0.0 <= v <= 5.0.01 CVE
5.1.0 <= v <= 5.1.01 CVE
5.2.0 <= v <= 5.3.21 CVE
6.0.0 <= v <= 6.0.01 CVE
6.0.0 <= v <= 6.0.31 CVE
6.0.0 <= v <= 6.2.01 CVE
6.1.0 <= v <= 6.1.01 CVE
6.1.1 <= v <= 6.1.11 CVE
6.2.0 <= v <= 6.2.01 CVE
6.2.1 <= v <= 6.2.11 CVE
6.2.2 <= v <= 6.2.21 CVE
7.0.0 <= v < 7.1.101 CVE
7.0.0 <= v <= 7.1.111 CVE
7.0.0 <= v <= 7.1.51 CVE
7.0.0 <= v <= 7.1.91 CVE
8.0.0 <= v < 8.0.41 CVE
8.0.0 <= v < 8.0.71 CVE
8.0.0 <= v < 8.1.101 CVE
8.0.0 <= v < 8.1.51 CVE
8.0.0 <= v <= 8.0.11 CVE
8.0.0 <= v <= 8.0.61 CVE
8.0.0 <= v <= 8.0.81 CVE
8.0.0 <= v <= 8.1.111 CVE
8.0.0 <= v <= 8.1.31 CVE
8.0.0 <= v <= 8.1.51 CVE
8.0.0 <= v <= 8.1.91 CVE
9.0.0 <= v < 9.1.31 CVE
9.0.0 <= v < 9.2.101 CVE
9.0.0 <= v < 9.2.41 CVE
9.0.0 <= v <= 9.0.01 CVE
9.0.0 <= v <= 9.1.11 CVE
9.0.0 <= v <= 9.1.31 CVE
9.0.0 <= v <= 9.2.31 CVE

Fixed in

10.0.44 CVEs
8.1.113 CVEs
8.1.73 CVEs
9.2.13 CVEs
9.2.33 CVEs
9.2.53 CVEs
9.2.63 CVEs
9.2.93 CVEs
> 8.1.102 CVEs
> 8.1.62 CVEs
> 8.1.72 CVEs
> 9.2.02 CVEs
> 9.2.12 CVEs
> 9.2.42 CVEs

Find a version

82 CVEs

Sort

Apache Traffic Server: Malformed chunked message body allows request smuggling
CVE-2025-65114
Patch
CWE-444
High · CVSS 7.5
EPSS 0.4% (35th pct)2026-04-02
Apache Traffic Server: A simple legitimate POST request causes a crash
CVE-2025-58136
Patch
CWE-670
High · CVSS 7.5
EPSS 0.7% (48th pct)2026-04-02
Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL
CVE-2025-31698
Patch
CWE-284
High · CVSS 7.5
EPSS 0.4% (37th pct)2025-06-19
Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin
CVE-2025-49763
Patch
CWE-400
High · CVSS 7.5
EPSS 0.6% (47th pct)2025-06-19
Apache Traffic Server: Malformed chunked message body allows request smuggling
CVE-2024-53868
Patch
CWE-444
High · CVSS 7.5
EPSS 0.6% (46th pct)2025-04-03
Medium vulnerability · 2025-03-06
CVE-2024-38311
Patch
CWE-20
Medium · CVSS 6.3
EPSS 0.8% (54th pct)2025-03-06
Medium vulnerability · 2025-03-06
CVE-2024-56195
Patch
CWE-284
Medium · CVSS 6.3
EPSS 0.7% (50th pct)2025-03-06
Medium vulnerability · 2025-03-06
CVE-2024-56196
Patch
CWE-284
Medium · CVSS 6.3
EPSS 0.7% (50th pct)2025-03-06
Apache Traffic Server: Expect header field can unreasonably retain resource
CVE-2024-56202
Patch
CWE-440
Medium · CVSS 4.3
EPSS 0.8% (53th pct)2025-03-06
Medium vulnerability · 2024-11-20
CVE-2018-9481
Patch
CWE-125
Medium · CVSS 6.5
EPSS 0.1% (4th pct)2024-11-20
Apache Traffic Server: Server process can fail to drop privilege
CVE-2024-50306
Patch
CWE-252
Critical · CVSS 9.1
EPSS 1.6% (73th pct)2024-11-14
Apache Traffic Server: Valid Host field value can cause crashes
CVE-2024-50305
Patch
CWE-20
High · CVSS 7.5
EPSS 0.9% (57th pct)2024-11-14
Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack
CVE-2024-38479
Patch
CWE-20
High · CVSS 7.5
EPSS 0.8% (53th pct)2024-11-14
Apache Traffic Server: Incomplete field name check allows request smuggling
CVE-2023-38522
Patch
CWE-444
High · CVSS 7.5
EPSS 1.0% (59th pct)2024-07-26
High vulnerability · 2024-07-26
CVE-2024-35296
Patch
CWE-20
High · CVSS 8.2
EPSS 1.1% (62th pct)2024-07-26
Critical vulnerability · 2024-07-26
CVE-2024-35161
Patch
CWE-444
Critical · CVSS 9.1
EPSS 1.0% (58th pct)2024-07-26
High vulnerability · 2024-04-10
CVE-2024-31309
Patch
CWE-20
High · CVSS 7.5
EPSS 94.6% (100th pct)2024-04-10
Apache Traffic Server: Malformed http/2 frames can cause an abort
CVE-2023-39456
Patch
CWE-20
High · CVSS 7.5
EPSS 53.5% (99th pct)2023-10-17
Apache Traffic Server: s3_auth plugin problem with hash calculation
CVE-2023-41752
Patch
CWE-200
High · CVSS 7.5
EPSS 1.2% (66th pct)2023-10-17
Medium vulnerability · 2023-10-10
CVE-2023-44487
CISA KEV
Public exploit
Patch
CWE-400
Added to CISA KEV 2023-10-10
Medium · CVSS 6.9
EPSS 100.0% (100th pct)2023-10-10
Critical vulnerability · 2023-08-09
CVE-2023-33934
Patch
CWE-444
Critical · CVSS 9.1
EPSS 1.1% (62th pct)2023-08-09
Apache Traffic Server: Invalid Range header causes a crash
CVE-2022-47185
Patch
CWE-20
High · CVSS 7.5
EPSS 1.5% (71th pct)2023-08-09
High vulnerability · 2023-06-14
CVE-2023-30631
Patch
CWE-20
High · CVSS 7.5
EPSS 2.0% (79th pct)2023-06-14
High vulnerability · 2023-06-14
CVE-2023-33933
Patch
CWE-200
High · CVSS 7.5
EPSS 1.5% (72th pct)2023-06-14
Apache Traffic Server: The TRACE method can be use to disclose network information
CVE-2022-47184
Patch
CWE-200
High · CVSS 7.5
EPSS 1.5% (72th pct)2023-06-14
Medium vulnerability · 2022-12-19
CVE-2022-40743
Patch
Workaround
CWE-79
Medium · CVSS 6.1
EPSS 1.1% (62th pct)2022-12-19
Medium vulnerability · 2022-12-19
CVE-2022-37392
Patch
CWE-754
Medium · CVSS 5.3
EPSS 1.1% (62th pct)2022-12-19
High vulnerability · 2022-12-19
CVE-2022-32749
Patch
CWE-754
High · CVSS 7.5
EPSS 1.3% (67th pct)2022-12-19
High vulnerability · 2022-08-10
CVE-2022-31779
Patch
CWE-20
High · CVSS 7.5
EPSS 2.0% (78th pct)2022-08-10
Improper input validation on HTTP/2 headers
CVE-2022-25763
Patch
CWE-444
High · CVSS 7.5
EPSS 1.6% (74th pct)2022-08-10

Showing 30 of 82

Apache Software Foundation traffic server Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other Apache Software Foundation products

Frequently asked questions

References

Track Apache Software Foundation traffic server vulnerabilities