Author: cmcfarlen Date: Tue Jul 28 00:20:49 2026 New Revision: 86278 Log: Add artifacts for 10.1.4 rc0
Added: dev/trafficserver/10.1.4/ dev/trafficserver/10.1.4/release-notes-10.1.4.md dev/trafficserver/10.1.4/trafficserver-10.1.4-rc0.tar.bz2 (contents, props changed) dev/trafficserver/10.1.4/trafficserver-10.1.4-rc0.tar.bz2.asc (contents, props changed) dev/trafficserver/10.1.4/trafficserver-10.1.4-rc0.tar.bz2.sha512 Added: dev/trafficserver/10.1.4/release-notes-10.1.4.md ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ dev/trafficserver/10.1.4/release-notes-10.1.4.md Tue Jul 28 00:20:49 2026 (r86278) @@ -0,0 +1,168 @@ +# Apache Traffic Server 10.1.4 — Release Notes (draft) + +Security release · 135 changes since 10.1.3 (git-branch commits merged with the 10.1.4 milestone PRs) + + +**CVEs addressed:** CVE-2021-32564, CVE-2026-22068, CVE-2026-33267, CVE-2026-33930 + + +## Security / Memory Safety + +- Replace VLA with heap allocation in cachekey appendEncoded `8798d5fb0` +- Fix out-of-bounds write in MIME obs-fold handling `5642692b8` +- regex_remap: Overflow in url_len Leads to Stack Overflow `41c2a9f42` +- Fix integer overflow in MIME header parsing `5a8eaaede` +- Fix leaks of POST failures `440673560` +- Replace VLAs with ts::LocalBuffer in HostDB SRV handling `fee925ab3` +- Fix OOB read in H2 get_received_frame_count `097214327` +- Add bounds checks to DNS answer parsing before NS_GET macros `371718e22` +- Bound status code parsing to prevent integer overflow `000c067b5` +- Avoid stack VLA in log filter wiping `6efd0e7cd` +- Validate PROXY v1 port bounds `6bdf628fa` +- Guard txn_box stack allocations `dcd52cf1f` +- libswoc: Validate IPv6 hextet bounds `d352bbcdc` +- Reject overflowing XPACK integers `64508368a` +- iocore: tighten IOBuffer and AIO bounds checks `578ea293c` +- access_control: cap stack buffer for cookie base64 decode `d38b565eb` +- rate_limit: Fix active counter underflow `17a61676e` +- HTTPHdr: fix use-after-free in destroy() leaving dangling m_http `21194a309` +- ESI: cap HTTP request length to prevent size_t overflow `869f11006` +- Prevent unbounded recursion in host-down Range fallback `8f28a21e0` +- CVE-2021-32564: Fix ChunkHandler Flow Control `9b28dd2f0` +- Fix an integer overflow in HdrHeap `5b3e16a9d` +- ja3_fingerprint: tighten encode_word_buffer bounds `1aa63ddf8` +- cripts: fix use-after-free in TSRemapDoRemap `c3113b40b` +- CVE-2026-33267: 10.1.x: Strip external @ headers before plugin hooks `1fc143066` +- cripts: Fix global Client::URL MLoc leak `40457999a` +- slice: Check for Integer underflow in firstblockbytes `3ef84614b` +- http2: Reject CONTINUATION accumulation that overflows header_blocks_length `f168e0c72` +- cache: Move openReadStartEarliest recursion counter off CacheVC to fix UAF `688adb872` +- CVE-2026-33930: Bound host header buffer `20eba2d36` +- uri_signing: replace stack arrays with LocalBuffer `07d452523` +- CVE-2026-22068: regex_map: anchor host matching to the full hostname `b121cc6c2` + +## HTTP/2 & HTTP/3 + +- Close connection if unneccesary H2 SETTINGS frame arrives `f240780d1` +- Reject Transfer-Encoding in HTTP/2 and HTTP/3 headers `c11c21a42` +- Enforce per-field size limit in HPACK/QPACK string decoding `5f55a845e` +- Reject oversized HPACK indexes `ca81ad5fd` +- Bound outstanding HTTP/2 SETTINGS `750eb2d3e` +- Fix max_settings_per_minute condition `94518fba5` +- stream_editor: allocate rules in contdata_t ctor `bc536d7f8` +- Verify H2 origin certs on session reuse `1306020f6` +- Set default value of proxy.config.http2.default_buffer_water_mark to 32KB `ec7aff494` +- Invoke Continuation operator bool, not pointer-to-bool `69b963fec` +- Gate H2 reads during async hooks `11076f475` +- Drop H2 origin trailers for H1 clients `7fda96a38` +- http2: Defer HPACK dynamic-table updates until encoding succeeds `3c696a6e1` + +## TLS / SNI / PROXY + +- Fix SNI/hostname comparison to check full string length `1ae0b55b4` +- Fix inverted condition in SNI_IpAllow::TestClientSNIAction `f6c6ab353` +- Update SNI_IpAllow::TestClientSNIAction autest `9be6dc04a` +- Add nullptr check before calling SSL_shutdown `063922262` +- Keep OCSP map on init failure `a5a2c8a2e` +- Handle addressless PROXY headers in TLS `dc354abad` +- Guard outbound server_name SNI policy `109cccce6` +- TLSSNISupport: own outbound_sni_policy bytes across config reload `763b2a0fc` +- SSLSNIConfig: fix SNI partial-match policy bypass `2c90be4b7` +- certifier: Reject unsafe SNI names `42051ca6f` +- SSLNetVConnection: deregister async handshake eventfd on connection teardown `e9f9df923` +- Fix: cancel stale TLS accept timeouts so session acceptors don't abort `7e23f58bf` + +## HTTP parsing / headers + +- #13400 — doc: fix Via decoder ring URL (/tools/via moved to /via.html) (#13400) `34cf5b353` +- Reject Transfer-Encoding where chunked is not the final coding `2efafacb1` +- Fix inverted condition for nonstandard method matching in ACL filtering `7606f49b2` +- Fix length check of MethodMod::check `956e6237a` +- URL: reject parsed ports outside uint16 range `86e3084d5` +- Reject oversized multiplexer chunks `9d17c4282` +- Avoid UB when URL scheme is absent in scheme_get `b86722577` +- doc: cover uri_signing cdniuc uri-regex in regex best practices `91c829f4c` +- Strip Connection-listed headers per RFC 9110 §7.6.1 `6ec473486` +- authproxy: Don't assert on auth response with no header fields `d614e83d5` +- Guard against missing delimiter in url_sig C= parameter `35f9e04b0` +- compress: Wrap isspace so obs-text Content-Type bytes don't trigger UB `8fc73b46f` +- Reject header fields exceeding the uint16 field-length limit `2694c217b` +- ESI: Fix URL include validation in version 10.1.x `c324d369c` +- http: reject chunked extension quoted-string values containing CR or LF `bb7f7263d` +- Fix race in remap table refcount during reload `6a4db2d9d` +- http: reject a bare LF chunked trailer terminator under strict parsing `76eb46146` +- Expand URI normalization test coverage for userinfo handling `928a87459` +- 10.1.x: Fix chunked passthrough flow-control deadlock (drop_chunked_trailers=0) `a2bc011ea` +- esi: add <sys/socket.h> for AF_INET/AF_INET6 in IncludeUrlValidator `ffba51c87` + +## Cache + +- Return evacuation bucket by reference not by value `0a24b3f92` +- Fix FetchSM header block copying `01c4b757e` +- lua: Invalidate cached main_ctx when slot is outside instance's range `22c37a549` +- HttpSM: Stop tracking the fire-and-forget cache-delete Action `1a9174361` +- cache_range_requests: use std::string spill buffer for building override cachekey `97cbb7c3f` +- Combo handler: Refactor Cache-Control parsing and update gold test `7f5887286` +- http: drain request body on internally generated cache responses `f26e77bef` + +## DNS / HostDB / Parent selection + +- Enforce 16-bit srv_offset invariant in HostDBInfo::assign `0c79954bc` +- Keep loop detection on outbound-transparent ports `0821898f6` +- Cap stale_response SIE buffering `63744a5f4` +- Guard parent mark-down on UNAVAILABLE_SERVER retry `19c796be3` +- DNS: fix TCP length-prefix read under edge-triggered epoll `4268da172` +- ParentSelection: increase size of mapWrapped array for compat with strategies `30dcca07e` +- NextHopRoundRobin: update ring size for wrapping when switching rings `94cde4421` +- Invalidate dns_info.addr when claiming resolved without DNS `48de5a48f` +- parent_selection: Cap retries to one per window via failedAt CAS `0f36b3133` + +## Plugins + +- rate_limit: Fix queue bypass `0e6215028` +- compress: stop gzip transform after deflate() error `12560ab23` +- cripts: Fix UB array write in remap instance initialization `961baec59` +- cripts: Fix path traversal in File::Path::Rebase `d705d29ba` +- rate_limit: Fix ip-rep UB writes `e04d7fdf9` +- Constrain prefetch relative paths `8fcdebe10` +- background_fetch: fix inverted size operator and broken value wildcard `facd883e5` +- lua: Add checks on server request hdr `9bcb090be` +- Combo handler: Reject empty Content-Type when allowlist is configured `d4a09d6ad` +- ESI: bound for nested esi html comment `510eed9c7` +- header_rewrite: Copy set-body-from response body with memcpy `b6d7ef850` +- xdebug: Cap X-Remap header length to actual buffer content `aa9c569ae` +- Add admin-guide reference for writing secure regex rules `f04180cbb` +- cripts: Fix HRW bridge issues, add autests `7941b2a5f` +- cripts: Fix abort on duplicate query keys `987f8fa9b` +- header_rewrite: Fix cookie key over-read `41a78eefc` +- ts_lua: clear rri pointer in http_ctx after remap returns `ec93e0f29` +- ts_lua: use sockaddr_storage for ts_lua_fetch client address `c1f8f7d78` +- cripts: Fix Bundle::Headers server-side header removal `fdf69ca1b` +- lua: Free transform context when client-hook VConn closes `8d845f992` +- webp_transform: bound buffered body and ImageMagick decode `c2b40948d` +- header_rewrite: Fix IPv6 CIDR masking for non-aligned prefixes `17b39ec9d` +- combo_handler.test.py: Fix empty type test output `b01f9632e` +- combo_handler.test.py: realign gold-file TestRun indices for 10.1.x `0d67596dc` +- Regex: preserve RE_ENDANCHORED semantics on PCRE2 < 10.30 `edebf3f38` +- esi: drop tsutil from esicore link deps to avoid plugin ODR `beea5e4e7` +- esi: guard optarg null before setHostAllowRegex to satisfy clang analyzer `a74a0fb2a` + +## Management / RPC + +- #13329 — Avoid JSONRPC client write spins (#13329) `56b31e084` +- Add uds-perm/uds-user/uds-group port options `09b346acc` +- mgmt/rpc: create JSONRPC unix socket with intended mode atomically `d73bd60a9` + +## Other + +- Limit CONNECT body preclusion to successful responses `19b2c089e` +- Server Session: Make sure read_buffer is empty before pooling a server session `c5b9f8c7a` +- tscpp: hold intercept try-lock guard via shared mutex `bb83ee26d` +- Avoid signed tolower for name bytes `ef8ecaa55` +- Use ParseRules::is_digit on raw network bytes in HTTP parser `fe5a87d52` +- Preserve dynamic-port flag across tunnel_route mapping ops `9379a4310` +- HttpTunnel: Guard get_producer(VIO*) against dead producers `3f5bdd419` +- Honor number_of_redirections for plugin-initiated redirects `4793de5d0` +- ip_allow: add default CONNECT destination rules `4ed3b4105` +- PendingAction: Don't let CAS failure overwrite the caller's action `535ff7915` +- Guard remap against shutdown table teardown `75b6ce380` Added: dev/trafficserver/10.1.4/trafficserver-10.1.4-rc0.tar.bz2 ============================================================================== Binary file. No diff available. Added: dev/trafficserver/10.1.4/trafficserver-10.1.4-rc0.tar.bz2.asc ============================================================================== Binary file. No diff available. Added: dev/trafficserver/10.1.4/trafficserver-10.1.4-rc0.tar.bz2.sha512 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ dev/trafficserver/10.1.4/trafficserver-10.1.4-rc0.tar.bz2.sha512 Tue Jul 28 00:20:49 2026 (r86278) @@ -0,0 +1 @@ +9c15fb5b8b4fdaf1e8d37266d6058cb8aeed127779586946e9b23d36e412b62d4604c256a47b8426d17a1b70a5113474f829a02ee41786b28469b45a58f7ca9a *trafficserver-10.1.4-rc0.tar.bz2
