Browse CVEs

CRITICAL 9.1 CVE-2026-58163 Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: … Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 HIGH 7.5 CVE-2026-58164 Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Ser… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 HIGH 7.5 CVE-2026-58175 Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 … Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 HIGH 7.5 CVE-2026-58178 The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 HIGH 7.5 CVE-2026-58180 The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 th… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 CRITICAL 10.0 CVE-2026-58162 The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server:… Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 HIGH 8.8 CVE-2026-50622 Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated … Atlas 2.6.0+ Fix from $1,9502026-07-29 HIGH 8.7 CVE-2026-58157 Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic S… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 HIGH 8.2 CVE-2026-58159 Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 HIGH 7.5 CVE-2026-58161 Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: fr… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 MEDIUM 6.5 CVE-2026-58160 Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 … Traffic Server 9.2.15 / 10.1.4+ Fix from $1,6002026-07-29 MEDIUM 5.9 CVE-2026-58158 Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,6002026-07-29 HIGH 7.3 CVE-2026-23904 Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network a… Kyuubi 1.12.0+ Fix from $1,9502026-07-29 HIGH 7.5 CVE-2026-65324 Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This … Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 CRITICAL 9.3 CVE-2026-58155 Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Tr… Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 HIGH 8.9 CVE-2026-58154 Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: fr… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 HIGH 8.3 CVE-2026-58153 Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue … Traffic Server 10.1.4+ Fix from $1,9502026-07-29 HIGH 7.5 CVE-2026-58151 Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic … Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 MEDIUM 5.9 CVE-2026-58152 Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,6002026-07-29 CRITICAL 10.0 CVE-2026-57834 Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9… Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 CRITICAL 10.0 CVE-2026-58150 Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic … Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 CRITICAL 9.3 CVE-2026-41920 Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 thr… Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 MEDIUM 5.9 CVE-2026-33930 Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host hea… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,6002026-07-29 CRITICAL 9.1 CVE-2026-33267 Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 t… Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 MEDIUM 5.3 CVE-2026-22068 Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, fro… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,6002026-07-29 MEDIUM 5.3 CVE-2026-24033 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache T… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,6002026-07-29 CRITICAL 9.8 CVE-2026-66713 Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Foundation Apache Axis2/Java through 2.0.0… Axis2\/java 2.0.1+ Fix from $2,3002026-07-28 HIGH 7.5 CVE-2026-66299 Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through… Tomcat 9.0.121 / 10.1.58+ Fix from $1,9502026-07-28 HIGH 7.5 CVE-2026-59878 Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach … Activemq 5.19.9 / 6.2.8+ Fix from $1,9502026-07-28 MEDIUM 6.5 CVE-2026-61487 Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypas… Activemq 5.19.9 / 6.2.8+ Fix from $1,6002026-07-28