Loading story…
German authorities published security advisories for Apache Traffic Server and Apache Tomcat/Tomcat Native, warning of multiple vulnerabilities affecting the widely used web proxy, caching, and Java application server products. The notices identify separate issues in the two Apache projects, indicating that organizations running these technologies should review vendor guidance and determine whether exposed internet-facing services or internal application platforms are affected.
The advisories provide limited public detail, but the affected software is commonly deployed in enterprise web delivery and application environments, raising the risk of service disruption, unauthorized access, or further compromise if vulnerable instances remain unpatched. Security teams are expected to prioritize asset identification, apply available updates from the Apache projects and downstream vendors, and monitor systems using Apache Traffic Server, Apache Tomcat, and Tomcat Native for signs of exploitation or abnormal activity.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
dCERT published advisory 2026-1020 covering multiple vulnerabilities affecting Apache Tomcat and Tomcat Native. No additional technical synopsis was provided in the reference.
dCERT published advisory 2026-0958 covering multiple vulnerabilities in Apache Traffic Server. No additional technical synopsis was provided in the reference.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two significant vulnerabilities have been identified in Apache Tomcat, each with distinct attack vectors and impacts. CVE-2025-61795 is an improper resource shutdown or release vulnerability that can lead to a denial-of-service (DoS) condition if temporary files from multipart uploads are not cleaned up promptly, potentially exhausting disk space and exposing sensitive data. This issue affects Tomcat versions 11.0.0-M1 through 11.0.11, 10.1.0-M1 through 10.1.46, 9.0.0.M1 through 9.0.109, and several end-of-life versions, with patches available in 11.0.12, 10.1.47, and 9.0.110 and later. CVE-2025-55752 is a relative path traversal vulnerability introduced by a regression in the fix for a previous bug, allowing attackers to bypass security constraints and potentially upload malicious files if specific, non-default configurations are present. This vulnerability affects Tomcat versions 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, 9.0.0.M11 through 9.0.108, and certain EOL versions, with fixes in 11.0.11, 10.1.45, and 9.0.109 and later. Both vulnerabilities require prompt attention from administrators, especially those running affected Tomcat versions. The DoS vulnerability (CVE-2025-61795) can be exploited by attackers to exhaust server resources, while the path traversal flaw (CVE-2025-55752) could lead to remote code execution under specific conditions. Organizations are advised to upgrade to the latest patched versions to mitigate these risks and review their Tomcat configurations to ensure that non-default features such as HTTP PUT requests and URL rewriting are not unnecessarily enabled.
Jun 29, 2026
Apache Traffic Server has received security updates for **16 vulnerabilities**, including **four critical** and **eleven high-severity** issues affecting versions `8.0.0` through `8.1.9`, `9.0.0` through `9.2.14`, and `10.0.0` through `10.1.3`. CSIRT Italia said the flaws can enable **arbitrary code execution, denial of service, security restriction bypass, information disclosure, and tampering**, and assigned the advisory a high systemic impact score. Apache recommends upgrading affected deployments to **`9.2.15`** or **`10.1.4`**. The published CVEs include **`CVE-2026-58150`**, a critical HTTP/2 `Transfer-Encoding` handling flaw that enables downgrade request smuggling, as well as **`CVE-2026-58159`** for ACL bypass, **`CVE-2026-58161`** for TLS/SNI memory-safety crashes, and **`CVE-2026-58151`** for HTTP/2 resource-exhaustion denial of service. Additional issues affect multiple plugins, including **ESI** SSRF and recursion in `CVE-2026-58178`, stack and integer overflows in `regex_remap` (`CVE-2026-58179`), stack exhaustion in `uri_signing` and `url_sig` (`CVE-2026-58181`), resource-consumption flaws in `ts_lua` (`CVE-2026-58182`), crashes in `prefetch` (`CVE-2026-58183`), and memory-safety weaknesses in experimental plugins (`CVE-2026-58188`).
Jul 31, 2026
German authorities published advisories for **multiple vulnerabilities** affecting both **Apache HTTP Server** and **Apache Airflow** components, expanding the list of enterprise Apache software requiring review. One notice, `dCERT Advisory 2026-1331`, covers several flaws in Apache HTTP Server, a widely deployed web server used in internet-facing and internal application environments. A separate notice, `dCERT Advisory 2026-1636`, reports multiple vulnerabilities in **Apache Airflow** provider packages, specifically the **Google** and **FAB** providers. While the advisories provided no public synopsis in the referenced notices, the disclosures indicate that organizations using these Apache products should identify affected deployments, review vendor guidance, and prioritize patching or other mitigations for exposed systems and workflow orchestration environments.
Jun 29, 2026