Apache Traffic Server

Every one of the 118 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attackCVE-2024-31309Apache Software Foundation · CVSS 7.5 · 92% likely

   CWE-20

2. Apache Traffic Server: Malformed http/2 frames can cause an abortCVE-2023-39456Apache Software Foundation · CVSS 7.5 · 58% likely

   CWE-20

3. Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0…CVE-2018-1318Apache Software Foundation · 7.6% likely

   CWE-20

4. A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade t…CVE-2018-8022Apache Software Foundation · 7.4% likely

   CWE-20

5. Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versi…CVE-2018-8040Apache Software Foundation · 7.2% likely

   CWE-668

6. When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in ca…CVE-2018-8005Apache Software Foundation · 6.8% likely

   CWE-400

7. There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2…CVE-2018-8004Apache Software Foundation · 6.2% likely

   CWE-4441 bounty report

8. Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using…CVE-2019-10079Apache · 4.6% likely

   CWE-770

9. Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.CVE-2021-27737Apache · 3.7% likely
10. Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amo…CVE-2020-9494Apache Software Foundation · 3.7% likely

    CWE-770

11. Incorrect handling of url fragment leads to cache poisoningCVE-2021-27577Apache Software Foundation · 3.4% likely

    CWE-444

12. There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to versions 7.1.9 and 8.…CVE-2019-17565Apache · 3.2% likely

    CWE-444

13. There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to versions 7.1.9 and 8.0.…CVE-2019-17559Apache · 3.2% likely

    CWE-444

14. Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding.CVE-2017-5659Apache Software Foundation · 3.0% likely

    CWE-20

15. Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.CVE-2016-5396Apache Software Foundation · 2.9% likely

    CWE-399

16. There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers. Upgr…CVE-2020-1944Apache · 2.7% likely

    CWE-444

17. Dynamic stack buffer overflow in cachekey pluginCVE-2021-35474Apache Software Foundation · 2.7% likely

    CWE-121

18. Request Smuggling - multiple attacksCVE-2021-37149Apache Software Foundation · 2.7% likely

    CWE-20

19. Request Smuggling - transfer encoding validationCVE-2021-37148Apache Software Foundation · 2.7% likely

    CWE-20

20. Request Smuggling - LF line endingCVE-2021-37147Apache Software Foundation · 2.5% likely

    CWE-444

21. ATS stops accepting connections on FreeBSDCVE-2021-41585Apache Software Foundation · 2.5% likely

    CWE-20

22. Improper HTTP/2 scheme and method validationCVE-2022-31779Apache Software Foundation · 2.5% likely

    CWE-20

23. HTTP/2 framing vulnerabilitiesCVE-2022-31780Apache Software Foundation · 2.5% likely

    CWE-20

24. Insufficient Validation of HTTP/1.x HeadersCVE-2022-28129Apache Software Foundation · 2.5% likely

    CWE-20

25. Reading HTTP/2 frames too many timesCVE-2021-32567Apache Software Foundation · 2.4% likely

    CWE-20

26. Specific sequence of HTTP/2 frames can cause ATS to crashCVE-2021-32566Apache Software Foundation · 2.4% likely

    CWE-20

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.