Round one migration of ports from automake{19,110} to automake1117e80cde328trafficserver -- resource consumptionentered 2020-07-02
Port details
www/trafficserver 10.1.0
Fast, scalable and extensible HTTP proxy server
Port info
- Maintainer
- gaod@hychen.org
- Packages
- latest: 10.1.0
- Upstream
- Higher version available: 10.2.1
- Last update
- to 10.1.0 · 1b26a2794c
- Quarterly
- 2026Q4: 10.1.0
- WWW
- https://trafficserver.apache.org/
- Links
- cgit · VuXML · Report wrong data
Install
- Package
# pkg install trafficserverinstalls 10.1.0 fromlatest; fromquarterly(2026Q4) 10.1.0- Port
# cd /usr/ports/www/trafficserver && make install clean# make -C /usr/ports/www/trafficserver config # change options first
- Size
- 4.0 MiB download · 17 MiB installed
- Depends on
- archivers/brotli 1.2.1,1, devel/cjose 0.8.0.20260912, devel/hwloc2 2.12.1_1, devel/jansson 2.15.1_1, devel/libunwind 20250904, devel/pcre 8.45_4, devel/pcre2 10.49, lang/luajit 2.1.0.20260908, lang/perl5.42 5.42.3
- License
- APACHE20
- Creates
- user
www, groupwww - Options
- 0 of 4 on in the package
Show the 4 options that are off
GEOIP IMAGEMAGICK MIMALLOC X11
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 10.1.0 | ✗ | – |
| FreeBSD 15 | 10.1.0 | ✗ | – |
| FreeBSD 14 | 10.1.0 | ✗ | ✗ |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 10.1.0 | ✗ | – |
| FreeBSD 14 | 10.1.0 | ✗ | ✗ |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed (41)
The CVE record lists the packaged version 10.1.0 as affected, and no VuXML entry names the CVE. What does this mean?
Update to 10.1.4 fixes all 41 unaddressed CVEs.
Fixed up to each version, cumulative: 10.1.2 2 · 10.1.3 3 · 10.1.4 41
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-58179 | 9.2 | 2026-07-29 | The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.… |
| CVE-2026-58161 | 9.2 | 2026-07-29 | Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
| CVE-2026-58155 | 9.2 | 2026-07-29 | Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from… |
| CVE-2026-58154 | 9.2 | 2026-07-29 | Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
| CVE-2026-58151 | 8.7 | 2026-07-29 | Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0… |
| CVE-2026-58188 | 8.4 | 2026-07-29 | Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, fr… |
| CVE-2026-58162 | 8.4 | 2026-07-29 | The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 throug… |
| CVE-2026-58184 | 8.3 | 2026-07-29 | The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Se… |
| CVE-2026-58177 | 8.3 | 2026-07-29 | The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 th… |
| CVE-2026-58164 | 8.3 | 2026-07-29 | Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 th… |
| CVE-2026-58163 | 8.3 | 2026-07-29 | Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through… |
| CVE-2026-58189 | 8.2 | 2026-07-29 | Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8… |
| CVE-2026-58182 | 8.2 | 2026-07-29 | The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. This issue affects Apache Traffic Server: from 8.0.0 thr… |
| CVE-2026-58186 | 8.2 | 2026-07-29 | The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 th… |
| CVE-2026-58185 | 8.2 | 2026-07-29 | The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from … |
| CVE-2026-58183 | 8.2 | 2026-07-29 | The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, fr… |
| CVE-2026-58181 | 8.2 | 2026-07-29 | The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 throu… |
| CVE-2026-58180 | 8.2 | 2026-07-29 | The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from… |
| CVE-2026-58175 | 8.2 | 2026-07-29 | Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, f… |
| CVE-2026-58178 | 8.2 | 2026-07-29 | The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11… |
Show all 41
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-58158 | 8.2 | 2026-07-29 | Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11… |
| CVE-2026-65324 | 8.2 | 2026-07-29 | Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apac… |
| CVE-2026-33930 | 8.2 | 2026-07-29 | Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host header overflows the st… |
| CVE-2026-58150 | 7.8 | 2026-07-29 | Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0… |
| CVE-2026-33267 | 7.7 | 2026-07-29 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. User… |
| CVE-2026-59173 | 7.5 | 2026-07-18 | Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.… |
| CVE-2025-65114 | 7.5 | 2026-04-02 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 thro… |
| CVE-2025-58136 | 7.5 | 2026-04-02 | A bug in POST request handling causes a crash under a certain condition. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12… |
| CVE-2026-58159 | 7.0 | 2026-07-29 | Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1… |
| CVE-2026-57834 | 7.0 | 2026-07-29 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 thro… |
| CVE-2026-41920 | 7.0 | 2026-07-29 | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users … |
| CVE-2026-58157 | 6.9 | 2026-07-29 | Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: from 8.0.0 … |
| CVE-2026-58152 | 6.9 | 2026-07-29 | Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, … |
| CVE-2026-24033 | 6.9 | 2026-07-29 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from … |
| CVE-2026-22068 | 6.9 | 2026-07-29 | Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, from 9.0.X through 9.2.… |
| CVE-2026-65100 | 6.3 | 2026-07-29 | Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync… |
| CVE-2026-58187 | 6.3 | 2026-07-29 | The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server:… |
| CVE-2026-58160 | 6.3 | 2026-07-29 | Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, f… |
| CVE-2026-58156 | 6.3 | 2026-07-29 | Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8… |
| CVE-2026-65325 | 6.3 | 2026-07-29 | Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache T… |
| CVE-2026-58153 | 6.3 | 2026-07-29 | Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traff… |
VuXML only (0)
Listed in VuXML, the packaged version 10.1.0 is still in the affected range; pkg audit reports it. What does this mean?
None.
Fixed (3)
Show 3 fixed
VuXML entries whose affected range the packaged version has left.
trafficserver -- unspecified vulnerabilityentered 2014-09-05
Apache Traffic Server -- heap overflow vulnerabilityentered 2012-03-24
Problem reports (1) · open in Bugzilla, most recently changed first
| PR | Summary | Status | Changed |
|---|---|---|---|
| 292748 | maintainer-feedback? latest www/trafficserver (10.1) won't start | New | 2026-01-27 |
Commits (105)
Autotools update. Read ports/UPDATING 20100915 for details. Approved by: portmgr (for Mk/bsd.port.mk part) Tested by: Multiple -exp runs8262a7b51d
- Mark IGNORE on < 7.x, official support only 7.0 and above Submitted by: Jui-Nan Lin <jnlin AT csie.nctu.edu.tw> (maintainer) Notified by: pointyhat via pav8f8fb86156
- Tweak rc.d script: * We prefer ports scripts to REQUIRE: LOGIN * KEYWORD: shutdown is preferred for scripts that start persistent services * Remove "empty default" variable assignment, which is neither necessary nor desirable Submitted by: dougb Approved by: Jui-Nan Lin <jnlin AT csie.nctu.edu.tw> (maintainer)5bfb183a3a
Add trafficserver 2.1.1, a fast, scalable and extensible HTTP proxy server. PR: ports/149676 Submitted by: Jui-Nan Lin <jnlin at csie.nctu.edu.tw>d477915849