CVE-2018-11783: sslheaders plugin extracts information from the client certificate and sets headers in the request based on...

Security readout for executives and security teams

Apache Traffic Server deployments using the sslheaders plugin may have accepted client-supplied headers that should have been controlled by the proxy. If backend applications trusted those headers as client-certificate identity, a user could potentially be misidentified. The public bundle does not provide CVSS, confirmed impact details, or patch version names. Limited to Apache Traffic Server versions 6.0.0-6.0.3, 7.0.0-7.1.5, and 8.0.0-8.0.1 with the sslheaders plugin configured. Risk is higher when upstream applications rely on those headers as authenticated client-certificate attributes. Prioritize review for internet-facing ATS proxies or services using client certificates for customer, partner, or administrative identity. Without evidence of exploitation or CVSS, this is not automatically critical, but identity spoofing risk can be business-significant in affected architectures. Mitigation focus: Inventory Apache Traffic Server versions and sslheaders plugin usage.; Review Apache Traffic Server advisory guidance for supported fixed releases or configuration changes.; Move affected deployments off the listed vulnerable versions following vendor guidance..

Prepared

Jun 6, 2026, 21:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.