Description
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Remediation
References
Related Vulnerabilities
WordPress Plugin WP Ajax Recent Posts 'number' Parameter Cross-Site Scripting (1.0.1)
MongoDb Use After Free Vulnerability (CVE-2026-8336)
WordPress Plugin Photo Gallery, Images, Slider in Rbs Image Gallery Remote Code Execution (2.0.14)
WebLogic Uncontrolled Resource Consumption Vulnerability (CVE-2025-21549)