PatchTheCVEtraffic server vulnerabilities and fixes
Recent CVEs affecting traffic server, with upgrade or downgrade steps. 7 tracked.
traffic server has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-07-29. Highest priority: CVE-2026-33267 (score 60/100).
- CVE-2026-33267 CRITICAL 10.0 UPGRADE Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: f
- CVE-2026-41920 CRITICAL 9.3 UPGRADE Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: fro
- CVE-2026-58153 HIGH 8.3 UPGRADE Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when co
- CVE-2026-22068 HIGH 8.2 UPGRADE Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic
- CVE-2026-58177 HIGH 8.1 UPGRADE The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors
- CVE-2026-24033 HIGH 7.2 UPGRADE Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traff
- CVE-2026-65325 MEDIUM 4.8 UPGRADE Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate co
FAQ
How do I fix traffic server vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is traffic server being exploited right now?
None of the tracked traffic server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which traffic server CVE should I patch first?
CVE-2026-33267 currently ranks highest (60/100): Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: f.