Omkhar Arasaratnam

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions prior to 3.3.1 **Description** The secrets masker in the UI fails to hide values stored under sensitive key names when they are nested inside a list, tuple, or set beyond the recursion-depth limit. This results in Airflow Variables with deeply-nested values being displayed unmasked in the Variables UI. This issue serves as a shoulder-surfing defense and does not bypass access-control boundaries, as authenticated users with UI access can already retrieve the full value via the Variables REST API. **Recommendations** Upgrade to apache-airflow version 3.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 10.0.X through 10.1.3 Apache Traffic Server versions 9.0.X through 9.2.14 **Description** Regular Expression without Anchors vulnerability allows regex mappings to match with malicious domain names. **Recommendations** Upgrade Apache Traffic Server versions 10.0.X through 10.1.3 to version 10.1.4. Upgrade Apache Traffic Server versions 9.0.X through 9.2.14 to version 9.2.15.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Abusive HTTP/2 framing and flow-control can cause the server to crash or lead to resource exhaustion. **Recommendations** Upgrade versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** When converting HTTP/2 to HTTP/1, the software forwards HTTP/2 origin trailers to HTTP/1 clients without applying the necessary chunked framing. Chunked framing is a mechanism in HTTP/1.1 that allows a server to send data as a series of chunks, which is required to properly transmit trailers (additional headers sent after the main body). **Recommendations** Upgrade to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server contains memory-safety errors that allow the system to write out of bounds or overflow integers during the parsing of MIME and HTTP headers. **Recommendations** Upgrade versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server truncates header names that exceed a certain length. This behavior enables header aliasing, request smuggling, and policy bypass. **Recommendations** Upgrade versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server mis-parses ports in URLs and userinfo, which allows for a port-based access-control bypass. **Recommendations** Upgrade versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server drops the per-stream buffer cap during the dechunking of HTTP/2 or HTTP/3 responses. This behavior allows a slow client to exhaust the server memory. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying that the server certificate covers the hostname of the new request. **Recommendations** Upgrade versions 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server improperly reuses server sessions and tunnels, which can lead to data exposure across different client connections. **Recommendations** Upgrade Apache Traffic Server versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade Apache Traffic Server versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** IP access controls can be bypassed on UDS listeners and through ACL matching errors. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** An out-of-bounds read occurs during the parsing of DNS answers. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** The software can crash due to null dereferences and dangling references during the handling of TLS (Transport Layer Security) and SNI (Server Name Indication). **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** The certifier plugin generates certificates based on the client SNI (Server Name Indication), which can be controlled by an attacker. **Recommendations** Upgrade Apache Traffic Server versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade Apache Traffic Server versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server mishandles on-disk cache fields and object lifetimes, which can lead to state corruption or system crashes. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server allows a redirect-limit bypass when plugins reset the retry counter. This behavior enables Server-Side Request Forgery (SSRF) amplification, a technique where an attacker leverages the server to send a large number of requests to a target system. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully. Consequently, an encode failure causes the encoder to become out of sync with the peer decoder, leading to the corruption of subsequent header blocks on the connection. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Use-after-free and time-of-check/time-of-use errors exist in the remap configuration handling. Use-after-free occurs when a program continues to use a pointer after it has been freed, and time-of-check/time-of-use is a race condition where a resource is modified between the time it is checked and the time it is used. **Recommendations** Upgrade versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Memory leaks occur when handling HostDB SRV records. **Recommendations** Upgrade versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** The Cripts framework contains out-of-bounds writes, path traversal, and use-after-free errors. Out-of-bounds writes occur when data is written outside the boundary of a fixed-length block of memory. Path traversal allows access to files and directories outside the intended folder. Use-after-free happens when a program continues to use a pointer after it has been freed. **Recommendations** Upgrade to version 10.1.4.