Improper Input Validation in Apache Traffic Server by Apache
CVE-2024-38311

6.3MEDIUM

Key Information:

Vendor
Apache
Status
Apache Traffic Server
Vendor
CVE Published:
6 March 2025

Badges

👾 Exploit Exists📰 News Worthy

Summary

An improper input validation vulnerability exists in Apache Traffic Server, affecting versions from 8.0.0 to 8.1.11, 9.0.0 to 9.2.8, and 10.0.0 to 10.0.3. This vulnerability could allow an attacker to manipulate input, potentially leading to unauthorized operations. Users are strongly advised to upgrade to Apache Traffic Server versions 9.2.9 or 10.0.4, which address the issue and bolster security.

Affected Version(s)

Apache Traffic Server 8.0.0 <= 8.1.11

Apache Traffic Server 9.0.0 <= 9.2.8

Apache Traffic Server 10.0.0 <= 10.0.3

News Articles

favicon imageGBHackers News

New Apache Traffic Server Flaws Allow Malformed Request Exploits

The Apache Software Foundation has disclosed several vulnerabilities affecting its Traffic Server software.

References

https://lists.apache.org/thread/btofzws2yqskk2n7f01r3l181...
vendor-advisory

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by GBHackers News

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ben Kallus
.