Resolves: CVE-2025-58136 - A simple legitimate POST request causes a crash CVE-2025-65114 - Malformed chunked message body allows request smuggling Changes with Apache Traffic Server 10.1.2 #12864 - Fix ppa log field. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-7839a46d9d 2026-04-25 01:21:36.171766+00:00 -------------------------------------------------------------------------------- Name : trafficserver Product : Fedora 44 Version : 10.1.2 Release : 1.fc44 URL : https://trafficserver.apache.org/ Summary : Fast, scalable and extensible HTTP/1.1 and HTTP/2 caching proxy server Description : Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching and reusing frequently-requested web pages, images, and web service calls. Proxying - Easily add keep-alive, filter or anonymize content requests, or add load balancing by adding a proxy layer. Fast - Scales well on modern SMP hardware, handling 10s of thousands of requests per second. Extensible - APIs to write your own plug-ins to do anything from modifying HTTP headers to handling ESI requests to writing your own cache algorithm. Proven - Handling over 400TB a day at Yahoo! both as forward and reverse proxies, Apache Traffic Server is battle hardened. -------------------------------------------------------------------------------- Update Information: Resolves: CVE-2025-58136 - A simple legitimate POST request causes a crash CVE-2025-65114 - Malformed chunked message body allows request smuggling Changes with Apache Traffic Server 10.1.2 #12864 - Fix ppa log field #13037 - Fix prev_is_cr flag handling in chunked encoding parser #13040 - HttpSM - make sure we have avalid buffer to write on. -------------------------------------------------------------------------------- ChangeLog: * Thu Apr 2 2026 Jered Floyd - 10.1.2-1 - Update to upstream 10.1.2 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2453244 - trafficserver-10.1.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=2453244 [ 2 ] Bug #2454965 - CVE-2025-58136 trafficserver: Apache Traffic Server: Denial of Service via POST request handling [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2454965 [ 3 ] Bug #2454966 - CVE-2025-65114 trafficserver: Apache Traffic Server: Request smuggling due to malformed chunked messages [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2454966 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-7839a46d9d' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching and reusing frequently-requested web pages,. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2022-62b61a8542 2022-12-29 01:09:28.690982 --------------------------------------------------------------------------------Name : trafficserver Product : Fedora 37 Version : 9.1.4 Release : 1.fc37 URL : https://trafficserver.apache.org/ Summary : Fast, scalable and extensible HTTP/1.1 and HTTP/2 caching proxy server Description : Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching and reusing frequently-requested web pages, images, and web service calls. Proxying - Easily add keep-alive, filter or anonymize content requests, or add load balancing by adding a proxy layer. Fast - Scales well on modern SMP hardware, handling 10s of thousands of requests per second. Extensible - APIs to write your own plug-ins to do anything from modifying HTTP headers to handling ESI requests to writing your own cache algorithm. Proven - Handling over 400TB a day at Yahoo! both as forward and reverse proxies, Apache Traffic Server is battle hardened. --------------------------------------------------------------------------------Update Information: Update to 9.1.4, resolves CVE-2022-32749, CVE-2022-37392, CVE-2022-40743 --------------------------------------------------------------------------------ChangeLog: * Mon Dec 19 2022 Jered Floyd 9.1.4-1 - Update to 9.1.4,resolves CVE-2022-32749, CVE-2022-37392, CVE-2022-40743 --------------------------------------------------------------------------------References: [ 1 ] Bug #2154123 - trafficserver-9.1.4-rc0 is available https://bugzilla.redhat.com/show_bug.cgi?id=2154123 [ 2 ] Bug #2154896 - CVE-2022-32749 trafficserver: server crash under certain conditions [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2154896 [ 3 ] Bug #2154897 - CVE-2022-32749 trafficserver: server crash under certain conditions [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2154897 [ 4 ] Bug #2154899 - CVE-2022-37392 trafficserver: ATS is vulnerable to smuggle, cache poison, and DOS attacks [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2154899 [ 5 ] Bug #2154900 - CVE-2022-37392 trafficserver: ATS is vulnerable to smuggle, cache poison, and DOS attacks [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2154900 [ 6 ] Bug #2154902 - CVE-2022-40743 trafficserver: Security issues with the xdebug plugin [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2154902 [ 7 ] Bug #2154903 - CVE-2022-40743 trafficserver: Security issues with the xdebug plugin [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2154903 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-62b61a8542' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.