CVE-2018-11783: Apache Traffic Server

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.

Affected products

• Apache Traffic Server: from 6.0.0, up to and including 6.0.3; from 7.0.0, up to and including 7.1.5; from 8.0.0, up to and including 8.0.1

Published 2019-03-07. Last modified 2026-06-17.