CVE-2022-31778

Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.

Score

CVSS 3.1 7.5 High

Status

Modified - security@apache.org

Published

2022-08-10

Last modified

2024-08-03

Weaknesses

CWE-20

Affected products

• Traffic Server (Apache)
• Apache Traffic Server (Apache Software Foundation)
• Debian Linux (Debian)

References

• https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21
• https://lists.debian.org/debian-lts-announce/2023/04/msg00007.html
• https://www.debian.org/security/2022/dsa-5206