CVE-2020-9494
CVE-2020-9494
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.
CVSS 7.5 · High · EPSS 3.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache traffic server
- Versions
- 6.0.0 to 6.2.3: Affected
- 7.0.0 to 7.1.10: Affected
- 8.0.0 to 8.0.7: Affected
No fix published
trafficserver Debian:12
- Affected ranges
- ECOSYSTEM: < 8.0.8+ds-1
Update to 8.0.8+ds-1
trafficserver Ubuntu:16.04:LTS
- Versions
- 5.3.0-2ubuntu1
- 5.3.0-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
trafficserver Ubuntu:18.04:LTS
- Versions
- 7.0.0-5
- 7.1.2+ds-2
- 7.1.2+ds-2build1
- 7.1.2+ds-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
trafficserver Ubuntu:Pro:20.04:LTS
- Versions
- 8.0.5+ds-1
- 8.0.5+ds-2
- 8.0.5+ds-2build1
- 8.0.5+ds-2ubuntu1
- 8.0.5+ds-3
- 8.0.5+ds-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published