CVE-2024-35296

CWE-20 — Improper Input Validation5 documents5 sources
Severity
8.2HIGH
EPSS
0.1%
top 68.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Traffic ServerApache Software Foundation Apache Traffic Server
Timeline
PublishedJul 26

Description

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:LExploitability: 3.9 | Impact: 4.2

Affected Packages3 packages

▶NVDapache/traffic_server8.0.0 — 8.1.11+1
▶Debiantrafficserver< 8.1.11+ds-0+deb11u1+1

🔴Vulnerability Details

3
GHSA
GHSA-x5fg-377f-962v: Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests↗2024-07-26
▶
OSV
CVE-2024-35296: Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests↗2024-07-26
▶
CVEList
Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests↗2024-07-26
▶

📋Vendor Advisories

1
Debian
CVE-2024-35296: trafficserver - Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache loo...↗2024
▶