CVE-2024-50305: Apache Traffic Server: Valid Host field value can cause crashes
Valid Host header field can cause Apache Traffic Server to crash on some platforms.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.5+ds-0+deb12u4 - Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.5+ds-0+deb12u2 - Upgrade
Upgrade
alpine/trafficserver9to a version that resolves this vulnerability.Fixed in 9.2.6-r0 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.6 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50305?
CVE-2024-50305 is considered a critical vulnerability due to its ability to cause Apache Traffic Server crashes.
How do I fix CVE-2024-50305?
To address CVE-2024-50305, upgrade Apache Traffic Server to version 9.2.6 or later.
Which versions of Apache Traffic Server are affected by CVE-2024-50305?
CVE-2024-50305 affects Apache Traffic Server versions from 9.2.0 through 9.2.5.
Can CVE-2024-50305 cause data loss?
CVE-2024-50305 can lead to crashes but does not specifically indicate data loss.
Is there a specific platform impacted by CVE-2024-50305?
CVE-2024-50305 can cause crashes on some platforms running affected versions of Apache Traffic Server.