Apache Community

Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling

Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs

Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out

Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service

Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration

Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication

Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials

Apache Traffic Server: SNI to Host header matching policy is not properly enforced

Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode