Description
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.
References (6)
Core 6
Core References
Third Party Advisory mailing-list
x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2012-03/0118.html
Mailing List mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2012/Mar/260
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/52696
Various Sources x_refsource_misc
https://www.cert.fi/en/reports/2012/vulnerability612884.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1026847
Patch x_refsource_confirm
http://trafficserver.apache.org/downloads
Scores
EPSS
0.0347
EPSS Percentile
87.7%
Details
CWE
CWE-119
Status
published
Products (19)
apache/traffic_server
2.0.0 (2 CPE variants)
apache/traffic_server
2.0.1
apache/traffic_server
2.1.0
apache/traffic_server
2.1.1
apache/traffic_server
2.1.2
apache/traffic_server
2.1.3
apache/traffic_server
2.1.4
apache/traffic_server
2.1.5
apache/traffic_server
2.1.6
apache/traffic_server
2.1.7
... and 9 more
Published
Mar 26, 2012
Tracked Since
Feb 18, 2026