Remove ${PORTSDIR}/ from dependencies, categories v, w, x, y, and z.
With hat: portmgr
Sponsored by: Absolight72ea7e696btrafficserver -- resource consumptionentered 2020-07-02
Fast, scalable and extensible HTTP proxy server
# pkg install trafficserverinstalls 10.1.0 from latest; from quarterly (2026Q4) 10.1.0# cd /usr/ports/www/trafficserver && make install clean# make -C /usr/ports/www/trafficserver config # change options first
www, group www| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 10.1.0 | ✗ | – |
| FreeBSD 15 | 10.1.0 | ✗ | – |
| FreeBSD 14 | 10.1.0 | ✗ | ✗ |
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 10.1.0 | ✗ | – |
| FreeBSD 14 | 10.1.0 | ✗ | ✗ |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
The CVE record lists the packaged version 10.1.0 as affected, and no VuXML entry names the CVE. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-58179 | 9.2 | 2026-07-29 | The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.… |
| CVE-2026-58161 | 9.2 | 2026-07-29 | Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
| CVE-2026-58155 | 9.2 | 2026-07-29 | Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from… |
| CVE-2026-58154 | 9.2 | 2026-07-29 | Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
| CVE-2026-58151 | 8.7 | 2026-07-29 | Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0… |
| CVE-2026-58188 | 8.4 | 2026-07-29 | Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, fr… |
| CVE-2026-58162 | 8.4 | 2026-07-29 | The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 throug… |
| CVE-2026-58184 | 8.3 | 2026-07-29 | The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Se… |
| CVE-2026-58177 | 8.3 | 2026-07-29 | The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 th… |
| CVE-2026-58164 | 8.3 | 2026-07-29 | Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 th… |
| CVE-2026-58163 | 8.3 | 2026-07-29 | Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through… |
| CVE-2026-58189 | 8.2 | 2026-07-29 | Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8… |
| CVE-2026-58182 | 8.2 | 2026-07-29 | The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 thr… |
| CVE-2026-58186 | 8.2 | 2026-07-29 | The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 th… |
| CVE-2026-58185 | 8.2 | 2026-07-29 | The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from … |
| CVE-2026-58183 | 8.2 | 2026-07-29 | The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, fr… |
| CVE-2026-58181 | 8.2 | 2026-07-29 | The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 throu… |
| CVE-2026-58180 | 8.2 | 2026-07-29 | The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from… |
| CVE-2026-58175 | 8.2 | 2026-07-29 | Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, f… |
| CVE-2026-58178 | 8.2 | 2026-07-29 | The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11… |
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-58158 | 8.2 | 2026-07-29 | Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11… |
| CVE-2026-65324 | 8.2 | 2026-07-29 | Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apac… |
| CVE-2026-33930 | 8.2 | 2026-07-29 | Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the st… |
| CVE-2026-58150 | 7.8 | 2026-07-29 | Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0… |
| CVE-2026-33267 | 7.7 | 2026-07-29 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. User… |
| CVE-2026-59173 | 7.5 | 2026-07-18 | Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.… |
| CVE-2025-65114 | 7.5 | 2026-04-02 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 thro… |
| CVE-2025-58136 | 7.5 | 2026-04-02 | A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12… |
| CVE-2026-58159 | 7.0 | 2026-07-29 | Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1… |
| CVE-2026-57834 | 7.0 | 2026-07-29 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 thro… |
| CVE-2026-41920 | 7.0 | 2026-07-29 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users … |
| CVE-2026-58157 | 6.9 | 2026-07-29 | Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: from 8.0.0 … |
| CVE-2026-58152 | 6.9 | 2026-07-29 | Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, … |
| CVE-2026-24033 | 6.9 | 2026-07-29 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from … |
| CVE-2026-22068 | 6.9 | 2026-07-29 | Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.… |
| CVE-2026-65100 | 6.3 | 2026-07-29 | Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync… |
| CVE-2026-58187 | 6.3 | 2026-07-29 | The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server:… |
| CVE-2026-58160 | 6.3 | 2026-07-29 | Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, f… |
| CVE-2026-58156 | 6.3 | 2026-07-29 | Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
| CVE-2026-65325 | 6.3 | 2026-07-29 | Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache T… |
| CVE-2026-58153 | 6.3 | 2026-07-29 | Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traff… |
Listed in VuXML, the packaged version 10.1.0 is still in the affected range; pkg audit reports it. What does this mean?
| PR | Summary | Status | Changed |
|---|---|---|---|
| 292748 | maintainer-feedback? latest www/trafficserver (10.1) won't start | New | 2026-01-27 |
Remove ${PORTSDIR}/ from dependencies, categories v, w, x, y, and z.
With hat: portmgr
Sponsored by: Absolight72ea7e696bDrop i386 from ONLY_FOR_ARCHS. 32-bit architectures don't seem to be supported, as `make configure' shows: checking size of void*... 4 configure: error: You are trying to build on a 32-bit platform, which is unsupported. ===> Script "configure" failed unexpectedly.78ca1e4943
1: Mark BROKEN on 9. 2: remove uneeded library (libboost_system.so) 3: bump version.cb5f0f0b9e
Upgrade to 6.0.0. PR: 206443 Submitted by: maintainer497b1e5ddd
Convert www ports to USES=sqlite and USES=firebird8c0520a0b3
Add a CACHEURL option. - not enabling it by default, it does not seem to build on 9 - convert to options helpers, and use OPTIONS_SINGLE instead of OPTIONS_RADIO. PR: 203973 Submitted by: maintainer Sponsored by: Absolight53e516c41e
Drop 8 support. With hat: portmgr Sponsored by: Absolight Differential Revision: https://reviews.freebsd.org/D36947f0f664d7e
By default libtool replaces -export-symbols <file> with -retain-symbols-file <file> on ELF systems, but this doesn't really do what -export-symbols is meant to do. On GNU ELF systems it converts <file> to a simple version script first and then uses -version-script instead of -retain-symbols-file. Let USES=libtool patch libtool scripts to do this on all systems with GNU ld(1). Bump PORTREVISION on all ports where the build log contains -export-symbols. audio/calf: This port builds a module that now exports only one function, but it also builds a number of executables that link to this module and expect to see other functions. Because it's already a bit dodgy to link to a module (libtool warns about this) let the module continue to export only one function and instead build an ordinary library from the same source that the executables can link to. Fix a number of other issues in the same Makefile.am and clean up the port Makefile. japanese/scim-honoka: Tries to hide all symbols that start with an underscore, but because this library is written in C++ all symbols start with _Z so it ends up hiding everything. Just don't hide anything at all like the textproc/scim configure script does. multimedia/schroedinger: Apply an upstream patch. textproc/scim-input-pad: Same as japanese/scim-honoka. PR: 201922 Approved by: portmgr (antoine) Exp-run by: antoinea374acb969
Add spdy support. PR: 201563 Submitted by: me@celogeek.com Approved by: maintainer715c085e5a
Upgrade to 5.3.1. PR: 200114 Submitted by: maintainer735b570f30
Change the way Perl modules are installed, update the default Perl to 5.18. Before, we had: site_perl : lib/perl5/site_perl/5.18 site_perl/perl_arch : lib/perl5/site_perl/5.18/mach perl_man3 : lib/perl5/5.18/man/man3 Now we have: site_perl : lib/perl5/site_perl site_arch : lib/perl5/site_perl/mach/5.18 perl_man3 : lib/perl5/site_perl/man/man3 Modules without any .so will be installed at the same place regardless of the Perl version, minimizing the upgrade when the major Perl version is changed. It uses a version dependent directory for modules with compiled bits. As PERL_ARCH is no longer needed in plists, it has been removed from PLIST_SUB. The USE_PERL5=fixpacklist keyword is removed, the .packlist file is now always removed, as is perllocal.pod. The old site_perl and site_perl/arch directories have been kept in the default Perl @INC for all Perl ports, and will be phased out as these old Perl versions expire. PR: 194969 Differential Revision: https://reviews.freebsd.org/D1019 Exp-run by: antoine Reviewed by: perl@ Approved by: portmgreee58d187e
Changes the pidfile used by daemon when start traffic server, the previous one conflicts with traffic_cop pidfile. PR: ports/193553 Submitted by: realhuang21@gmail.com Approved by: mentors (implicit)4e0fde3c13
The MAP_NORESERVE flag to mmap() has never been implemented in FreeBSD and is being removed. No portrev bump needed since the kernel will continue to accept this flag for old binaries even after support for it in new binaries is removed. PR: 193961 Approved by: portmgr (antoine)1ebd0e3345
Fix improper use of FORBIDDEN. With hat: portmgrd57381901f
- Update to 5.0.1 to fix CVE-2014-3525 - Patch Makefile.in instead of Makefile.am to avoid USE_AUTOTOOLS - Add USES=cpe, USES=libtool and INSTALL_TARGET=install-strip - Use /var instead of PREFIX/var - Use @sample7232ff7e62
- Update to 5.0.0 [1] - Transfer maintainership [2] PR: 192076 [1] 184160 [2] Submitted by: gaod@hychen.org [1][2]2758b97b15
- Switch devel/hwloc to USES=libtool, drop .la files - Bump dependent ports as .so version has changed - Add LICENSE_FILE - While here, fix stagedir reference in www/trafficserver Approved by: portmgr blanketa4a7ce7422
- Convert to USES=libtool - Add USE_AUTOTOOLS=autoheader so the configure header is regenerated - Add "AUTOMAKE_ARGS=-a -c -f" so build scripts are updated to match our version of automake - Remove "ACLOCAL_ARGS=-I build" because configure.ac contains AC_CONFIG_MACRO_DIR([build]) so aclocal looks inside "build" automaticallyb1b1756df4
Finish conversion to USES=lua941c31ac7a
Remove the last @comment $FreeBSD$ from plists. With hat: portmgr Sponsored by: Absolightcf28d260c6
The FreeBSD x11@ and graphics team proudly presents a zeising, kwm production, with help from dumbbell, bdrewery: NEW XORG ON FREEBSD 9-STABLE AND 10-STABLE This update switches over to use the new xorg stack by default on FreeBSD 9 and 10 stable, on osversions where vt(9) is available. It is still possible to use the old stack by specifying WITHOUT_NEW_XORG in /etc/make.conf . FreeBSD 8-STABLE and released versions of FreeBSD still use the old version. A package repository with binary packages for new xorg will be available soon. This patch also contains updates of libxcb and related ports, pixman, as well as some drivers and utilities. Bump portrevisions for xf86-* ports, as well as virtualbox-ose-additions due to xserver version change. Apart from these updates, the way shared libraries are handled has been changed for all xorg ports, as well as libxml2 and freetype, which means ltverhack is gone and as a consequence shared libraries have been bumped. The plan is that this change will make library bumps less likely in the future. All affected ports have had their portrevisions bumped as a consequence of this. Fix some issues where WITH_NEW_XORG weren't detected properly on CURRENT. Update instructions, hardware support, and more notes can be found on https://wiki.freebsd.org/Graphics Thanks to: all testers, bdrewery and the FreeBSD x11@ team exp-run by: bdrewery [1] PR: ports/187602 [1] Approved by: portmgr (bdrewery), core (jhb)39fc32e828
Chase boost and icu bump While here convert some LIB_DEPENDS4650a910d0
- Update to 4.1.2 - Build with clang on FreeBSD 10 and remove USE_GCC=any - added some configuration OPTIONS - added patch to fix segfault with current tcl - added patches to avoid crash on i386 - compile with libxml2, hwloc, boost - add user tserv for owning configuration and log directory - added stage support - enabled compiling WCCP and SSD support - use lua with JIT - install perl TS module PR: ports/185669 Submitted by: Radim Kolar <hsn@sendmail.cz> Approved by: maintainer timeout (3 weeks)e8ef133efb
Fix properties on pkg-pliste04b632220
- Convert to USES=tcl - Remove indifinitive article from COMMENT - Convert to single space after WWW: in pkg-descra518b2145e
- rename AL2 to APACHE20 in Mk/bsd.licenses.db.mk - svn move Templates/Licenses/AL2 Templates/Licenses/APACHE20 - add APACHE10 and APACHE11 to Mk/bsd.licenses.db.mk - add entry in UPDATING - bulk change all ports AL2 => APACHE20 - math/openfst/pkg-plist: remove share/licenses/openfst-1.3.4 PR: ports/184785 Submitted by: ohauer Reviewed by: tabthorpe Approved by: portmgr (tabthorpe@)4fb1cfb1cd
- Update to 3.2.5 [1] - Add pkgconfig dependency to fix configure on FreeBSD 9.x and 10.x [2] - Add USE_GCC=any to fix configure and compile on FreeBSD 10.x - Convert LIB_DEPENDS to new shlib format - Remove checks for old EoL FreeBSD versions - Support staging PR: ports/179268 [1] PR: ports/183174 [2] Submitted by: Hung-Yi Chen <gaod@hychen.org> [1] Reported by: Gunnar Flygt <gunnar.flygt@sr.se> [2] Approved by: maintainer timeout (19 weeks) [1] With hat: portmgrfaf39b9761
Add NO_STAGE all over the place in preparation for the staging support (cat: www)85fbf21ec5
- Convert USE_ICONV=yes to USES=iconv - Change USE_GNOME=pkgconfig|gnomehack to USES=pathfix|pkgconfig and USE_GETTEXT=yes to USES=gettext while here95e7081976
- Update to 3.2.4 Please note that this version has many FreeBSD fixes and improvements, but SRV DNS record support in this version is broken. PR: ports/170829 (based on) Submitted by: vfx9as <vfx9as@gmail.com> Approved by: jnlin@csie.nctu.edu.tw (maintainer)13685a9891
Update PCRE to 8.32 Introduces the UTF-32 library pcre32 Bump PORTREVISION in dependent portsb2c4fbb77a
Upgrade to 3.0.5. Approved by: maintainer362a1b3537
Update autoconf to 2.69 and automake to 1.12 PR: 166836 Tested by: Multiple -exp runs (pav)6d726b6c09
- Update to 3.0.4 - Security fix for CVE-2012-0256 PR: ports/166366 Submitted by: lwhsu Approved by: Jui-Nan Lin <jnlin@csie.nctu.edu.tw> (maintainer) Security: acab2f88-7490-11e1-865f-00e0814cab4e Feature safe: yesd1527fa043
- don't clobber configs on upgrades PR: ports/164740 Submitted by: jgh,rflynn@acsalaska.net Approved by: maintainer timeout (17 days)ece434de4a
Bump pcre library dependency due to 8.30 updatedbbf004162
- Update to 3.0.2 PR: 163166 Submitted by: farrokhi@ Approved by: maintainer timeout80ebe0c746
- The proper acronym for Apache Software License 2 is really AL2 - Thanks to crees@ for generating the initial patch PR: ports/163521 Submitted by: Pedro Giffuni <pfg apache.org> Hat: portmgr Exp run by: pave0ac1afbf4
Mark broken on powerpc as well as sparc64. (In fact, on all the tier-2s.) Hat: portmgr7d8608ab13
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS) - Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead
PR: 157936
Submitted by: myself
Exp-runs by: pav
Approved by: pav6f6fbe4bdfUpdate to 3.0.1 Fix build with custom LOCALBASE/PREFIX Add LICENSE PR: ports/159973 Submitted by: Radim Kolar <hsn@sendmail.cz> Approved by: wxs, tabthorpe (mentors, implicit), maintainer timeout543e319b95
Mark as broken on sparc64: does not configure.6f21add32a
- Use one ${FIND} command and ${REINPLACE_CMD} to patch - Remove unneeded DISTNAME
Submitted by: maintainer30959c1fe0- Update to 3.0.0 PR: ports/157870 Submitted by: Jui-Nan Lin <jnlin@csie.nctu.edu.tw> (maintainer)acc5ddacad
Update to libtool 2.4 Tested by: pav (multiple -exp runs)e0d39220da
- Update to 2.1.5 PR: ports/154234 Submitted by: lwhsu Approved by: Jui-Nan Lin <jnlin AT csie.nctu.edu.tw> (maintainer)2701369cc5
- Mark BROKEN on amd64/7: does not compile Reported by: pointyhat Feature safe: yes19d1d7e20d
Sync to new bsd.autotools.mk4a8684e352
- Update to 2.1.4 (maintainer submitted a new patch via IRC) - Use DATADIR and ETCDIR - Sort PLIST Changes: http://svn.apache.org/viewvc/trafficserver/traffic/trunk/CHANGES?revision=1033178&view=markup PR: ports/151793 (based on) Submitted by: rellik <rellik@pixnet.tw> Approved by: Jui-Nan Lin <jnlin@csie.nctu.edu.tw> (maintainer)d028381b1c
Punt autoconf267->autoconf2686abd00a86b