CVE-2022-25763: Improper input validation on HTTP/2 headers
Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.5+ds-0+deb12u4 - Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.1.3+ds-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25763?
CVE-2022-25763 has been classified as a high severity vulnerability.
How do I fix CVE-2022-25763?
To fix CVE-2022-25763, upgrade to Apache Traffic Server versions 8.1.7 or 9.2.0 and above.
Which versions of Apache Traffic Server are affected by CVE-2022-25763?
Apache Traffic Server versions 8.0.0 to 9.1.2 are affected by CVE-2022-25763.
What types of attacks can exploit CVE-2022-25763?
CVE-2022-25763 can be exploited to perform smuggling or cache poisoning attacks.
Is there a patch available for CVE-2022-25763?
Yes, patches for CVE-2022-25763 are available in the newer versions of Apache Traffic Server.