CVE-2024-38311: Apache Traffic Server: Request smuggling via pipelining after a chunked message body
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3.
Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38311?
CVE-2024-38311 has been classified as a moderate severity vulnerability due to improper input validation in Apache Traffic Server.
How do I fix CVE-2024-38311?
To mitigate CVE-2024-38311, users should upgrade Apache Traffic Server to version 9.2.9 or 10.0.4.
Which versions of Apache Traffic Server are affected by CVE-2024-38311?
CVE-2024-38311 affects Apache Traffic Server from versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.8, and 10.0.0 through 10.0.3.
What type of vulnerability is CVE-2024-38311?
CVE-2024-38311 is categorized as an improper input validation vulnerability.
What should I do if I cannot upgrade my Apache Traffic Server?
If you cannot upgrade, consider implementing strict input validation rules and monitoring for exploit attempts as an immediate mitigation strategy against CVE-2024-38311.