CVE-2021-32566: Specific sequence of HTTP/2 frames can cause ATS to crash
Published Jun 30, 2021
·Updated
Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.
Affected Software
5 affected componentsFixes available
debian/trafficserver
8.0.2+ds-1+deb10u68.1.7-0+deb10u28.1.7+ds-1~deb11u19.2.0+ds-2+deb12u19.2.2+ds-1
Apache Traffic Server>=7.0.0<=7.1.12
Apache Traffic Server>=8.0.0<=8.1.1
Apache Traffic Server>=9.0.0<=9.0.1
Debian Debian Linux=10.0
Event History
Jun 30, 2021
CVE Published
via MITRE·07:15 AM
Data Sourced
via MITRE·07:15 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2021-32566.
2
What is the severity level of CVE-2021-32566?
The severity level of CVE-2021-32566 is high with a score of 7.5.
3
What is the affected software?
The affected software is Apache Traffic Server versions 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, and 9.0.0 to 9.0.1.
4
How does CVE-2021-32566 impact the server?
CVE-2021-32566 allows an attacker to perform a denial-of-service (DoS) attack on the server.
5
Where can I find more information about CVE-2021-32566?
You can find more information about CVE-2021-32566 at the following references: [link1], [link2], [link3].