Apache Community

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 10.0.X through 10.1.3 Apache Traffic Server versions 9.0.X through 9.2.14 **Description** Regular Expression without Anchors vulnerability allows regex mappings to match with malicious domain names. **Recommendations** Upgrade Apache Traffic Server versions 10.0.X through 10.1.3 to version 10.1.4. Upgrade Apache Traffic Server versions 9.0.X through 9.2.14 to version 9.2.15.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 9.2.0 through 9.2.14 Apache Traffic Server versions 10.1.0 through 10.1.3 **Description** Improper Input Validation allows untrusted @ headers to spoof internal metadata. **Recommendations** Upgrade Apache Traffic Server versions 9.2.0 through 9.2.14 to version 9.2.15. Upgrade Apache Traffic Server versions 10.1.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 9.0.0 through 9.1.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Improper Access Control issue where the Server Name Indication (SNI) to Host header matching policy is not properly enforced. **Recommendations** Upgrade Apache Traffic Server versions 9.0.0 through 9.1.14 to version 9.1.15. Upgrade Apache Traffic Server versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server is susceptible to request smuggling, a technique where an attacker interferes with the way a website and its proxy server process sequences of HTTP requests, when chunked messages are malformed. **Recommendations** Upgrade versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server fails to reject the `Transfer-Encoding` header in HTTP/2 requests. This behavior allows for downgrade request smuggling, a technique where an attacker manipulates the request stream to confuse the proxy and the backend server about where a request ends and a new one begins. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Abusive HTTP/2 framing and flow-control can cause the server to crash or lead to resource exhaustion. **Recommendations** Upgrade versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server mishandles integers during the decoding of HPACK/XPACK headers, which leads to memory corruption. **Recommendations** Upgrade versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** When converting HTTP/2 to HTTP/1, the software forwards HTTP/2 origin trailers to HTTP/1 clients without applying the necessary chunked framing. Chunked framing is a mechanism in HTTP/1.1 that allows a server to send data as a series of chunks, which is required to properly transmit trailers (additional headers sent after the main body). **Recommendations** Upgrade to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server contains memory-safety errors that allow the system to write out of bounds or overflow integers during the parsing of MIME and HTTP headers. **Recommendations** Upgrade versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server mis-parses ports in URLs and userinfo, which allows for a port-based access-control bypass. **Recommendations** Upgrade versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server drops the per-stream buffer cap during the dechunking of HTTP/2 or HTTP/3 responses. This behavior allows a slow client to exhaust the server memory. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying that the server certificate covers the hostname of the new request. **Recommendations** Upgrade versions 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server improperly reuses server sessions and tunnels, which can lead to data exposure across different client connections. **Recommendations** Upgrade Apache Traffic Server versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade Apache Traffic Server versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server mishandles PROXY protocol input, which leads to the truncation of ports and a stack overflow. A stack overflow occurs when a program uses more stack space than is available, potentially causing the application to crash. **Recommendations** Upgrade Apache Traffic Server versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade Apache Traffic Server versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** IP access controls can be bypassed on UDS listeners and through ACL matching errors. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** An out-of-bounds read occurs during the parsing of DNS answers. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server mishandles on-disk cache fields and object lifetimes, which can lead to state corruption or system crashes. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Use-after-free and time-of-check/time-of-use errors exist in the remap configuration handling. Use-after-free occurs when a program continues to use a pointer after it has been freed, and time-of-check/time-of-use is a race condition where a resource is modified between the time it is checked and the time it is used. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** The Cripts framework contains out-of-bounds writes, path traversal, and use-after-free errors. Out-of-bounds writes occur when data is written outside the boundary of a fixed-length block of memory. Path traversal allows access to files and directories outside the intended folder. Use-after-free happens when a program continues to use a pointer after it has been freed. **Recommendations** Upgrade to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** The ESI plugin can recurse without bound and fetch URLs controlled by an attacker. **Recommendations** Upgrade to version 9.2.15. Upgrade to version 10.1.4.