CVE-2023-39456 Apache Traffic Server: Malformed http/2 frames can cause an abort

2023-10-1706:58:17

CWE-20

apache

www.cve.org

cve-2023-39456

apache traffic server

http/2 frames

improper input validation

upgrade

AI Score

7.8

Confidence

High

EPSS

0.002

Percentile

64.8%

JSON

Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2.

Users are recommended to upgrade to version 9.2.3, which fixes the issue.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Traffic Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "9.2.2",
        "status": "affected",
        "version": "9.0.0",
        "versionType": "semver"
      }
    ]
  }
]