Changes with Apache Traffic Server 10.1.4 #13400 - doc: fix Via decoder ring URL (/tools/via moved to /via.html) (#13400) #13329 - Avoid JSONRPC client write spins (#13329) Replace VLA with heap allocation in cachekey appendEncoded Fix SNI/hostname comparison to check full string length Close connection if unneccesary H2 SETTINGS frame arrives Reject Transfer-Encoding in HTTP/2 and HTTP/3 headers Reject Transfer-Encoding where chunked is not the final coding Fix out-of-bounds write in MIME obs-fold handling Enforce per-field size limit in HPACK/QPACK string decoding regex_remap: Overflow in url_len Leads to Stack Overflow Reject oversized HPACK indexes Fix integer overflow in MIME header parsing Fix inverted condition for nonstandard method matching in ACL filtering Limit CONNECT body preclusion to successful responses Fix inverted condition in SNI_IpAllow::TestClientSNIAction Update SNI_IpAllow::TestClientSNIAction autest rate_limit: Fix queue bypass compress: stop gzip transform after deflate() error Add nullptr check before calling SSL_shutdown Fix leaks of POST failures Server Session: Make sure read_buffer is empty before pooling a server session Enforce 16-bit srv_offset invariant in HostDBInfo::assign Replace VLAs with ts::LocalBuffer in HostDB SRV handling Fix OOB read in H2 get_received_frame_count Add bounds checks to DNS answer parsing before NS_GET macros cripts: Fix UB array write in remap instance initialization cripts: Fix path traversal in File::Path::Rebase Bound status code parsing to prevent integer overflow Avoid stack VLA in log filter wiping Validate PROXY v1 port bounds Guard txn_box stack allocations libswoc: Validate IPv6 hextet bounds Reject overflowing XPACK integers Bound outstanding HTTP/2 SETTINGS Fix max_settings_per_minute condition rate_limit: Fix ip-rep UB writes Fix length check of MethodMod::check iocore: tighten IOBuffer and AIO bounds checks stream_editor: allocate rules in contdata_t ctor tscpp: hold intercept try-lock guard via shared mutex URL: reject parsed ports outside uint16 range access_control: cap stack buffer for cookie base64 decode rate_limit: Fix active counter underflow Constrain prefetch relative paths Keep OCSP map on init failure Return evacuation bucket by reference not by value Handle addressless PROXY headers in TLS Guard outbound server_name SNI policy Verify H2 origin certs on session reuse TLSSNISupport: own outbound_sni_policy bytes across config reload Avoid signed tolower for name bytes Reject oversized multiplexer chunks Keep loop detection on outbound-transparent ports Set default value of proxy.config.http2.default_buffer_water_mark to 32KB Avoid UB when URL scheme is absent in scheme_get HTTPHdr: fix use-after-free in destroy() leaving dangling m_http ESI: cap HTTP request length to prevent size_t overflow Invoke Continuation operator bool, not pointer-to-bool Prevent unbounded recursion in host-down Range fallback Add uds-perm/uds-user/uds-group port options CVE-2021-32564: Fix ChunkHandler Flow Control Fix FetchSM header block copying Gate H2 reads during async hooks background_fetch: fix inverted size operator and broken value wildcard Fix an integer overflow in HdrHeap lua: Add checks on server request hdr SSLSNIConfig: fix SNI partial-match policy bypass Combo handler: Reject empty Content-Type when allowlist is configured ESI: bound for nested esi html comment ja3_fingerprint: tighten encode_word_buffer bounds Use ParseRules::is_digit on raw network bytes in HTTP parser header_rewrite: Copy set-body-from response body with memcpy Cap stale_response SIE buffering Guard parent mark-down on UNAVAILABLE_SERVER retry xdebug: Cap X-Remap header length to actual buffer content DNS: fix TCP length-prefix read under edge-triggered epoll Add admin-guide reference for writing secure regex rules cripts: Fix HRW bridge issues, add autests cripts: fix use-after-free in TSRemapDoRemap cripts: Fix abort on duplicate query keys header_rewrite: Fix cookie key over-read CVE-2026-33267: 10.1.x: Strip external @ headers before plugin hooks doc: cover uri_signing cdniuc uri-regex in regex best practices Preserve dynamic-port flag across tunnel_route mapping ops HttpTunnel: Guard get_producer(VIO*) against dead producers ts_lua: clear rri pointer in http_ctx after remap returns ts_lua: use sockaddr_storage for ts_lua_fetch client address cripts: Fix global Client::URL MLoc leak cripts: Fix Bundle::Headers server-side header removal slice: Check for Integer underflow in firstblockbytes ParentSelection: increase size of mapWrapped array for compat with strategies lua: Invalidate cached main_ctx when slot is outside instance's range HttpSM: Stop tracking the fire-and-forget cache-delete Action lua: Free transform context when client-hook VConn closes NextHopRoundRobin: update ring size for wrapping when switching rings certifier: Reject unsafe SNI names Drop H2 origin trailers for H1 clients http2: Reject CONTINUATION accumulation that overflows header_blocks_length Honor number_of_redirections for plugin-initiated redirects cache_range_requests: use std::string spill buffer for building override cachekey webp_transform: bound buffered body and ImageMagick decode header_rewrite: Fix IPv6 CIDR masking for non-aligned prefixes SSLNetVConnection: deregister async handshake eventfd on connection teardown Strip Connection-listed headers per RFC 9110 ยง7.6.1 http2: Defer HPACK dynamic-table updates until encoding succeeds authproxy: Don't assert on auth response with no header fields mgmt/rpc: create JSONRPC unix socket with intended mode atomically cache: Move openReadStartEarliest recursion counter off CacheVC to fix UAF CVE-2026-33930: Bound host header buffer uri_signing: replace stack arrays with LocalBuffer ip_allow: add default CONNECT destination rules Guard against missing delimiter in url_sig C= parameter Fix: cancel stale TLS accept timeouts so session acceptors don't abort CVE-2026-22068: regex_map: anchor host matching to the full hostname Invalidate dns_info.addr when claiming resolved without DNS PendingAction: Don't let CAS failure overwrite the caller's action parent_selection: Cap retries to one per window via failedAt CAS compress: Wrap isspace so obs-text Content-Type bytes don't trigger UB Reject header fields exceeding the uint16 field-length limit ESI: Fix URL include validation in version 10.1.x http: reject chunked extension quoted-string values containing CR or LF Fix race in remap table refcount during reload Guard remap against shutdown table teardown http: reject a bare LF chunked trailer terminator under strict parsing Expand URI normalization test coverage for userinfo handling Combo handler: Refactor Cache-Control parsing and update gold test combo_handler.test.py: Fix empty type test output combo_handler.test.py: realign gold-file TestRun indices for 10.1.x http: drain request body on internally generated cache responses 10.1.x: Fix chunked passthrough flow-control deadlock (drop_chunked_trailers=0) Regex: preserve RE_ENDANCHORED semantics on PCRE2 < 10.30 esi: drop tsutil from esicore link deps to avoid plugin ODR esi: add for AF_INET/AF_INET6 in IncludeUrlValidator esi: guard optarg null before setHostAllowRegex to satisfy clang analyzer