CVE-2021-32567

CWE-20 — Improper Input Validation5 documents5 sources

Severity

7.5HIGH

EPSS

7.9%

top 7.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Traffic Server Apache Software Foundation Apache Traffic Server Debian Debian Linux

Timeline

PublishedJun 30

Latest updateMay 24

Description

Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/traffic_server7.0.0 — 7.1.12+2

▶CVEListV5apache_software_foundation/apache_traffic_serverApache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1

▶Debiantrafficserver< 8.1.1+ds-1.1+1

Also affects: Debian Linux 10.0

🔴Vulnerability Details

GHSA

GHSA-jg59-5w24-mmc9: Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server↗2022-05-24

▶

OSV

CVE-2021-32567: Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server↗2021-06-30

▶

CVEList

Reading HTTP/2 frames too many times↗2021-06-30

▶

📋Vendor Advisories

Debian

CVE-2021-32567: trafficserver - Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allow...↗2021

▶