Omkhar Arasaratnam

The experimental wasm plugin contains a use-after-free flaw within its transaction-close handler. Additionally, the plugin forwards unvalidated metric IDs provided by the guest to the internal stats API.

A chunked transfer can stall until the connection times out when the server passes it through with trailers removed. This occurs because the system waits for trailer bytes that have already been dropped. This behavior is triggered by the `proxy.config.http.drop chunked trailers` configuration. In version 10.x, this feature is enabled by default, while in versions 8.1.11 and 9.2.x, it is disabled by default and only affects systems where it has been manually enabled.

An issue exists where the Nickname profile can experience a panic due to an out-of-bounds slice error. This occurs when the system attempts to transform specially crafted input into a destination buffer that is too short.

The secrets masker in the UI fails to hide values stored under sensitive key names when they are nested inside a list, tuple, or set beyond the recursion-depth limit. This results in Airflow Variables with deeply-nested values being displayed unmasked in the Variables UI. This issue serves as a shoulder-surfing defense and does not bypass access-control boundaries, as authenticated users with UI access can already retrieve the full value via the Variables REST API.

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully. Consequently, an encode failure causes the encoder to become out of sync with the peer decoder, leading to the corruption of subsequent header blocks on the connection.

Regular Expression without Anchors vulnerability allows regex mappings to match with malicious domain names.

Abusive HTTP/2 framing and flow-control can cause the server to crash or lead to resource exhaustion.

When converting HTTP/2 to HTTP/1, the software forwards HTTP/2 origin trailers to HTTP/1 clients without applying the necessary chunked framing. Chunked framing is a mechanism in HTTP/1.1 that allows a server to send data as a series of chunks, which is required to properly transmit trailers (additional headers sent after the main body).

Apache Traffic Server contains memory-safety errors that allow the system to write out of bounds or overflow integers during the parsing of MIME and HTTP headers.

Apache Traffic Server truncates header names that exceed a certain length. This behavior enables header aliasing, request smuggling, and policy bypass.

Apache Traffic Server mis-parses ports in URLs and userinfo, which allows for a port-based access-control bypass.

Apache Traffic Server drops the per-stream buffer cap during the dechunking of HTTP/2 or HTTP/3 responses. This behavior allows a slow client to exhaust the server memory.

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying that the server certificate covers the hostname of the new request.

Apache Traffic Server improperly reuses server sessions and tunnels, which can lead to data exposure across different client connections.

IP access controls can be bypassed on UDS listeners and through ACL matching errors.

An out-of-bounds read occurs during the parsing of DNS answers.

The software can crash due to null dereferences and dangling references during the handling of TLS (Transport Layer Security) and SNI (Server Name Indication).

The certifier plugin generates certificates based on the client SNI (Server Name Indication), which can be controlled by an attacker.

Apache Traffic Server mishandles on-disk cache fields and object lifetimes, which can lead to state corruption or system crashes.

Use-after-free and time-of-check/time-of-use errors exist in the remap configuration handling. Use-after-free occurs when a program continues to use a pointer after it has been freed, and time-of-check/time-of-use is a race condition where a resource is modified between the time it is checked and the time it is used.