CVE-2024-50305

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50305
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:traffic_server:*:-:*:*:*:*:*:*
History

04 Jun 2025, 16:15

Type Values Removed Values Added
References () https://lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y - () https://lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y - Mailing List, Vendor Advisory
CPE cpe:2.3:a:apache:traffic_server:*:-:*:*:*:*:*:*
First Time Apache traffic Server
Apache

14 Nov 2024, 19:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-120
Summary
  • (es) Un campo de encabezado de host válido puede provocar que Apache Traffic Server se bloquee en algunas plataformas. Este problema afecta a Apache Traffic Server: desde la versión 9.2.0 hasta la 9.2.5. Se recomienda a los usuarios actualizar a la versión 9.2.6, que soluciona el problema, o a la versión 10.0.2, que no lo tiene.

14 Nov 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-14 10:15

Updated : 2025-06-04 16:15

NVD link : CVE-2024-50305

Mitre link : CVE-2024-50305

CVE.ORG link : CVE-2024-50305

JSON object : View

Products Affected

apache

  • traffic_server
CWE
CWE-20

Improper Input Validation

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')