CVE-2019-10079

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions prior to 7.1.7 Apache Traffic Server versions prior to 8.0.4

Description The issue arises from incorrect handling of HTTP/2 requests, allowing a remote attacker to impact data confidentiality, integrity, and availability. Earlier versions of Apache Traffic Server did not limit the number of setting frames sent from the client using the HTTP/2 protocol, making them susceptible to HTTP/2 setting flood attacks.

Recommendations For versions prior to 7.1.7, upgrade to Apache Traffic Server 7.1.7 or later. For versions prior to 8.0.4, upgrade to Apache Traffic Server 8.0.4 or later.