CVE-2024-50305

🗓️ 14 Nov 2024 09:54:20Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 85 Views🌐 WEB

Valid Host header can crash Apache Traffic Serve

Reporter	Title	Published	Views	Family All 39
AlpineLinux	CVE-2024-50305	14 Nov 202409:54	–	alpinelinux
BDU FSTEC	The vulnerability of the Apache Traffic Server web server, related to insufficient validation of input data, allows attackers to cause service failures.	9 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-50305	14 Nov 202411:37	–	circl
CNNVD	Apache Traffic Server 安全漏洞	14 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-50305 Apache Traffic Server: Valid Host field value can cause crashes	14 Nov 202409:54	–	cvelist
Debian	[SECURITY] [DSA 5896-1] trafficserver security update	5 Apr 202513:15	–	debian
Debian CVE	CVE-2024-50305	14 Nov 202409:54	–	debiancve
Tenable Nessus	Debian dsa-5896 : trafficserver - security update	5 Apr 202500:00	–	nessus
Tenable Nessus	Fedora 39 : trafficserver (2024-589ea34c42)	22 Nov 202400:00	–	nessus
Tenable Nessus	Fedora 40 : trafficserver (2024-b3c4e8da81)	22 Nov 202400:00	–	nessus

NVD

Vulners

Vulnrichment

Node

apache traffic_serverRange9.0.0–9.2.6-

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Traffic Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "9.2.5",
        "status": "affected",
        "version": "9.2.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y

Parameter	Position	Path	Description	CWE
Host	header	/	Proof-of-concept DoS via crafted Host header against vulnerable Apache Traffic Server versions 9.2.0–9.2.5	CWE-20CWE-120

17 Jun 2026 08:04Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.00941

SSVC