CVE-2024-50305
CVE-2024-50305 · Apache Traffic Server: Valid Host field value can cause crashes
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
CVSS 7.5 · High · EPSS 0.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache traffic server
- Versions
- ≥ 9.2.0, ≤ 9.2.5: Affected (semver)
No fix published
trafficserver Debian:12
- Versions
- 9.2.0+ds-2
- 9.2.0+ds-2+deb12u1
- 9.2.1+ds-1
- 9.2.2+ds-1
- 9.2.3+ds-1
- 9.2.3+ds-1+deb12u1
- 9.2.4+ds-0+deb12u1
- 9.2.4+ds-1
- 9.2.4+ds-2
- 9.2.5+ds-0+deb12u1
- Affected ranges
- ECOSYSTEM: < 9.2.5+ds-0+deb12u2
Update to 9.2.5+ds-0+deb12u2
trafficserver Ubuntu:22.04:LTS
- Versions
- 8.1.1+ds-1.1
- 9.1.1+ds-2build1
- Affected ranges
- ECOSYSTEM: < 9.1.1+ds-2ubuntu0.1
Update to 9.1.1+ds-2ubuntu0.1
trafficserver Ubuntu:24.04:LTS
- Versions
- 9.2.1+ds-1build1
- 9.2.2+ds-1
- 9.2.3+ds-1
- 9.2.3+ds-1+deb12u1
- 9.2.3+ds-1+deb12u1build1
- 9.2.3+ds-1+deb12u1build3
- 9.2.3+ds-1+deb12u1build4
- Affected ranges
- ECOSYSTEM: < 9.2.3+ds-1+deb12u1ubuntu0.1
Update to 9.2.3+ds-1+deb12u1ubuntu0.1
trafficserver Ubuntu:25.10
- Versions
- 9.2.5+ds-1ubuntu1
- 9.2.5+ds-1ubuntu2
- Affected ranges
- ECOSYSTEM: < 9.2.5+ds-1ubuntu2.1
Update to 9.2.5+ds-1ubuntu2.1