CVE-2021-44040: HTTP request line fuzzing attacks
Published Mar 23, 2022
·Updated
Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.
Affected Software
5 affected componentsFixes available
debian/trafficserver
8.0.2+ds-1+deb10u68.1.7-0+deb10u28.1.7+ds-1~deb11u19.2.0+ds-2+deb12u19.2.2+ds-1
Apache Traffic Server>=8.0.0<=8.1.3
Apache Traffic Server>=9.0.0<=9.1.1
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Event History
Mar 23, 2022
CVE Published
via MITRE·02:05 PM
Data Sourced
via MITRE·02:05 PM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2021-44040?
CVE-2021-44040 is an Improper Input Validation vulnerability in request line parsing of Apache Traffic Server.
2
How does CVE-2021-44040 affect Apache Traffic Server?
CVE-2021-44040 allows an attacker to send invalid requests to Apache Traffic Server.
3
Which versions of Apache Traffic Server are affected by CVE-2021-44040?
CVE-2021-44040 affects Apache Traffic Server versions 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.
4
How severe is CVE-2021-44040?
CVE-2021-44040 has a severity rating of 7.5 (high).
5
How can I fix CVE-2021-44040?
To fix CVE-2021-44040, update to the recommended versions of Apache Traffic Server provided by Debian.