CVE-2024-38479

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

Score

CVSS 3.1 7.5 High

Status

Modified - security@apache.org

Published

2024-11-14

Last modified

2025-11-03

Weaknesses

CWE-20

Affected products

• Traffic Server (Apache)
• Apache Traffic Server (Apache Software Foundation)

References

• https://lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y
• https://lists.debian.org/debian-lts-announce/2025/02/msg00018.html