CVE-2024-35296: Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests
Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.
Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.5+ds-0+deb12u1 - Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.5+ds-0+deb12u4 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 8.1.11 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.5
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35296?
CVE-2024-35296 has a moderate severity level, as it can cause cache lookup failures in Apache Traffic Server.
How do I fix CVE-2024-35296?
To fix CVE-2024-35296, upgrade Apache Traffic Server to version 8.1.11 or 9.2.5.
What versions of Apache Traffic Server are affected by CVE-2024-35296?
CVE-2024-35296 affects Apache Traffic Server versions from 8.0.0 to 8.1.10 and from 9.0.0 to 9.2.4.
What consequences can arise from not addressing CVE-2024-35296?
Failing to address CVE-2024-35296 may result in improper request forwarding and inefficiencies in cache management.
Is there a workaround for CVE-2024-35296 if I cannot upgrade?
There are no officially recommended workarounds for CVE-2024-35296; upgrading is advised.