CVE-2024-38311CWE-20

Apache Traffic Server: Request smuggling via pipelining after a chunked message body

Medium · published March 6, 2025

CVSS v3.1
6.3
EPSS
1%
Percentile
59.6
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3.

Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00909 · 59.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-03-06T11:34Z
EPSS history
Timeline
  • 06 MAR 11:34Z
    Apache Traffic Server: Request smuggling via pipelining after a chunked message body
    cvelistv5