Apache Community

Apache Traffic Server: Malformed chunked message body allows request smuggling

Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling

Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory

Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely

Apache Traffic Server: Memory-safety errors in MIME and header parsing

Apache Traffic Server: URL and port parsing errors allow access-control bypass

Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification

Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins