PT-2024-5231 · Apache · Apache Traffic Server

Ben Kallus

·

CVE-2023-38522

·

Published

2024-07-26

·

Updated

2025-09-19

CVSS v2.0

7.6

High

VectorAV:N/AC:H/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 8.1.10 Apache Traffic Server versions 9.0.0 through 9.2.4
Description: The issue exists due to insufficient input validation, allowing an attacker to exploit the vulnerability and potentially conduct HTTP request smuggling attacks, which may also lead to cache poisoning if the origin servers are vulnerable.
Recommendations: For Apache Traffic Server versions 8.0.0 through 8.1.10, upgrade to version 8.1.11. For Apache Traffic Server versions 9.0.0 through 9.2.4, upgrade to version 9.2.5.

Exploit

Fix

DoS

HTTP Request/Response Smuggling

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-86CWE-444CWE-20

Related Identifiers

BDU:2024-05797
CVE-2023-38522
DLA-3897-1
DSA-5758-1
OESA-2024-1955

Affected Products

Apache Traffic Server