Apache Community

Apache Traffic Server: Improper server-session reuse can expose data across client connections

Apache Traffic Server: URL and port parsing errors allow access-control bypass

Apache Traffic Server: Memory-safety errors in MIME and header parsing

Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory

Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling

Apache Traffic Server: Malformed chunked message body allows request smuggling

Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata

Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework

Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely