CVE-2026-112381 is a vulnerability in Apache Traffic Server that causes a crash due to a null pointer dereference. This occurs when a client POST request is half-closed while a chunked origin response is being reparsed in a reentrant write-ready callback. The issue is timing-dependent and was introduced by backports related to CVE-2021-32564. Affected versions include 9.2.15, 10.1.4, and 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-111812 is a critical authorization vulnerability in Apache Traffic Server's origin_server_auth plugin. It allows a client to force the proxy to sign attacker-chosen AWS request headers using the proxy's own credentials. This flaw affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1. The vulnerability has a CVSS score of 10.0, indicating critical severity.
Apache Traffic Server's experimental tsmemcache plugin has a critical vulnerability (CVE-2026-111811) that allows unauthenticated network users to read, write, and delete the shared proxy cache. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and exactly 10.2.0. The vulnerability is due to missing authentication for critical functions in the plugin. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 contain a vulnerability that allows HTTP request smuggling via HEAD requests with Content-Length or Transfer-Encoding headers. This flaw is addressed in versions 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server versions 9.2.15, 10.1.4, and 10.2.0 have a vulnerability where the server writes an unthrottled diagnostic log line for every internal @ header stripped from a request. This can lead to uncontrolled resource consumption when a request contains many such headers, causing excessive log data generation. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server contains a critical vulnerability (CVE-2026-111815) involving improper certificate validation. The server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's strict verification policy. This flaw affects multiple versions from 8.0.0 through 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server versions 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 contain a vulnerability in the default outbound session-sharing policy. This flaw allows reuse of a pooled TLS session authenticated with one client certificate for a transaction that should present a different client certificate. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-111808 is an integer underflow vulnerability in Apache Traffic Server that allows exhaustion of an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This affects multiple versions from 8.0.0 through 10.2.0. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-111805 is a high-severity vulnerability in Apache Traffic Server that allows an attacker to exhaust an HTTP/1.1 origin's worker pool by sending a truncated HTTP/2 Content-Length value. This uncontrolled resource consumption can lead to denial of service conditions. The issue affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-114268 is a critical buffer overflow vulnerability in the Tenda BE3L Pro router firmware version 16.03.60.62. The flaw occurs in the formWifiBasicSet function within the /goform/WifiBasicSet file due to improper handling of the security_5g argument. Exploit code has been published, increasing the risk of exploitation. No patch information is currently available.
CVE-2026-111816 is a critical HTTP request/response smuggling vulnerability in Apache Traffic Server. The issue arises from the server forwarding a malformed 302 response that should have been rejected due to a parsing error. However, a Transfer-Encoding: chunked carve-out bypassed the rejection path, causing the server to store and serve a response that peers interpret differently. This discrepancy allows cache poisoning and response-framing desynchronization attacks. The vulnerability affects Apache Traffic Server versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.
CVE-2025-55702 is a high-severity HTTP request/response smuggling vulnerability in Apache Traffic Server. It occurs when a client sends a POST request with the Expect: 100-continue header and the origin server responds before reading the request body. This causes Apache Traffic Server to misinterpret the unread body as a new request, enabling an attacker behind a shared front-end proxy to smuggle requests past the front end and desynchronize responses for other users. The vulnerability affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
Vaadin Framework 8 versions from 8.16.0 up to 8.32.1 have an improper locking vulnerability in the VaadinService.requestEnd() method. A non-numeric v-uiId request parameter triggers an exception while holding a session lock, preventing the lock from being released. This causes subsequent requests to block indefinitely and can exhaust the server's thread pool, resulting in a denial of service. No authentication beyond a session cookie is required. The vulnerability is fixed in version 8.32.2 and later. Vaadin Framework 7 and versions 10 and later are not affected.
CVE-2025-31699 is a high-severity HTTP request/response smuggling vulnerability in Apache Traffic Server. It occurs when the server returns an origin connection to the shared pool while the origin is still waiting on a request body that the client declared but never fully sent, including cases using Expect: 100-continue. This allows the origin to misinterpret subsequent requests as leftover body data, enabling attackers to smuggle requests past access controls, disrupt other users' requests, or poison the cache. The issue affects multiple versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server's experimental magick plugin contains an argument injection vulnerability (CWE-88) that allows unauthenticated clients to control ImageMagick convert arguments in its default unsigned configuration. This affects versions from 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-92205 is a vulnerability in BusyBox related to libarchive that allows arbitrary file creation via a symlink directory traversal. It affects multiple Ubuntu package versions of BusyBox. The vulnerability has a medium severity with a CVSS score of 6.1. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.