CVE-2021-37150
HIGHApache Traffic Server 8.0.0-9.1.2 - Improper Input Validation in Header Parsing
Title source: llmDescription
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
References (5)
Core 5
Core References
Third Party Advisory vendor-advisory
https://www.debian.org/security/2022/dsa-5206
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J/
Mailing List, Third Party Advisory vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCSBQBYPOZSWS5LCOAQ6LJLRLXFIAW5A/
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2023/01/msg00019.html
Mailing List, Vendor Advisory
https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21
Scores
CVSS v3
7.5
EPSS
0.0116
EPSS Percentile
78.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-20
Status
published
Products (5)
apache/traffic_server
8.0.0 - 8.1.4
debian/debian_linux
10.0
debian/debian_linux
11.0
fedoraproject/fedora
35
fedoraproject/fedora
36
Published
Aug 10, 2022
Tracked Since
Feb 18, 2026