PT-2022-4094

CVE-2022-31780

Published

2022-08-10

Updated

2023-02-23

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 9.1.2

Description The issue is related to improper input validation in HTTP/2 frame handling, which can be exploited by an attacker to smuggle requests. This can potentially allow a remote attacker to execute arbitrary code due to weaknesses in handling HTTP requests.

Recommendations For Apache Traffic Server versions 8.0.0 through 9.1.2, update to a version that includes the fix for this issue to prevent request smuggling and potential code execution. As a temporary workaround, consider restricting access to the HTTP/2 frame handling module until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors