Vulnerabilities

TI-2023-19902 CVE-2023-38522 · GHSA-68qf-xhq3-9qj5

Apache Traffic Server: Incomplete field name check allows request smuggling

MEDIUM 41

Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00987 Published 2024-07-26 No fix listed CWE-444

TI-2024-23355 CVE-2024-35296 · GHSA-x5fg-377f-962v

LOW 38

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01085 Published 2024-07-26 No fix listed CWE-20

TI-2024-23237 CVE-2024-35161 · GHSA-j49j-p46f-pfcv

MEDIUM 43

Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0097 Published 2024-07-26 No fix listed CWE-444