p PatchFirst

CVE-2023-39456

CVE-2023-39456 · Apache Traffic Server: Malformed http/2 frames can cause an abort

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue.

CVSS 7.5 · High · EPSS 58.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache traffic server

    Versions
    • ≥ 9.0.0, ≤ 9.2.2: Affected (semver)

    No fix published

  • trafficserver Debian:12

    Versions
    • 9.2.0+ds-2
    • 9.2.0+ds-2+deb12u1
    • 9.2.1+ds-1
    • 9.2.2+ds-1
    • 9.2.3+ds-1
    Affected ranges
    • ECOSYSTEM: < 9.2.3+ds-1+deb12u1

    Update to 9.2.3+ds-1+deb12u1

  • trafficserver Ubuntu:Pro:22.04:LTS

    Versions
    • 8.1.1+ds-1.1
    • 9.1.1+ds-2build1
    • 9.1.1+ds-2ubuntu0.1~esm1
    • 9.1.1+ds-2ubuntu0.1
    • 9.1.1+ds-2ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →