CVE-2022-25763: Improper input validation on HTTP/2 headers
Published Aug 10, 2022
·Updated
Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Affected Software
6 affected componentsFixes available
debian/trafficserver<=8.0.2+ds-1+deb10u6
8.1.7-0+deb10u28.1.7+ds-1~deb11u19.2.0+ds-2+deb12u19.2.2+ds-1
Apache Traffic Server>=8.0.0<8.1.5
Apache Traffic Server>=9.0.0<9.1.3
Debian Debian Linux=11.0
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Event History
Aug 10, 2022
CVE Published
via MITRE·05:50 AM
Data Sourced
via MITRE·05:50 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-25763?
CVE-2022-25763 has been classified as a high severity vulnerability.
2
How do I fix CVE-2022-25763?
To fix CVE-2022-25763, upgrade to Apache Traffic Server versions 8.1.7 or 9.2.0 and above.
3
Which versions of Apache Traffic Server are affected by CVE-2022-25763?
Apache Traffic Server versions 8.0.0 to 9.1.2 are affected by CVE-2022-25763.
4
What types of attacks can exploit CVE-2022-25763?
CVE-2022-25763 can be exploited to perform smuggling or cache poisoning attacks.
5
Is there a patch available for CVE-2022-25763?
Yes, patches for CVE-2022-25763 are available in the newer versions of Apache Traffic Server.