CVE-2024-56202CWE-440

Apache Traffic Server: Expect header field can unreasonably retain resource

Medium · published March 6, 2025

CVSS v3.1
4.3
EPSS
1%
Percentile
58.4
In the wild
Unconfirmed
What it is

Expected Behavior Violation vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3.

Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00871 · 58.4th percentile
Weakness
CWE-440 · Expected Behavior Violation
Published
2025-03-06T11:09Z
EPSS history
Timeline
  • 06 MAR 11:09Z
    Apache Traffic Server: Expect header field can unreasonably retain resource
    cvelistv5