Improper Input Validation in Apache Traffic Server by Apache
CVE-2024-38311

6.3MEDIUM

Key Information:

Vendor
Apache
Status
Apache Traffic Server
Vendor
CVE Published:
6 March 2025

Summary

An improper input validation vulnerability exists in Apache Traffic Server, affecting versions from 8.0.0 to 8.1.11, 9.0.0 to 9.2.8, and 10.0.0 to 10.0.3. This vulnerability could allow an attacker to manipulate input, potentially leading to unauthorized operations. Users are strongly advised to upgrade to Apache Traffic Server versions 9.2.9 or 10.0.4, which address the issue and bolster security.

Affected Version(s)

Apache Traffic Server 8.0.0 <= 8.1.11

Apache Traffic Server 9.0.0 <= 9.2.8

Apache Traffic Server 10.0.0 <= 10.0.3

References

https://lists.apache.org/thread/btofzws2yqskk2n7f01r3l181...
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ben Kallus
.