CVE-2021-32565 HTTP Request Smuggling, content length with invalid charters

Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1...

CVE-2021-32565

Apache Traffic Server is affected by CVE-2021-32565 due to invalid values in the Content-Length header, enabling HTTP request smuggling. Affected releases: 7.0.0–7.1.12, 8.0.0–8.1.1, and 9.0.0–9.0.1. The issue’s root cause is improper handling of Content-Length values. Debian/DSA-4957-1 notes a f...

CVE-2021-32565

Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1...

CVE-2021-27577

Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1...

CVE-2021-27577 Incorrect handling of url fragment leads to cache poisoning

Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1...

CVE-2021-27577

The CVE-2021-27577 issue affects Apache Traffic Server (ATS) and is caused by incorrect handling of URL fragments, enabling cache poisoning. Affected versions include ATS 7.0.0–7.1.12, 8.0.0–8.1.1, and 9.0.0–9.0.1. Impact is cache poisoning with potential denial of service implications depending ...

CVE-2021-27577

Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1...

CVE-2021-32565: Inconsistent Interpretation of HTTP Requests

Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1...

CVE-2021-27577: Inconsistent Interpretation of HTTP Requests

Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1...

Apache Traffic Server 环境问题漏洞

An environmental issue vulnerability exists in Apache Traffic Server ATS, a set of scalable HTTP proxy and caching servers from the Apache Foundation, which stems from a failure to properly handle URL data segments. An attacker could exploit this vulnerability to affect the cache of the target...

Apache Traffic Server 环境问题漏洞

Apache Traffic Server or ATS or TS for short , is a high-performance , modular HTTP proxy and caching server . A security vulnerability exists in Apache Traffic Server versions 7.0.0 - 7.1.12, 8.0.0 - 8.1.1, 9.0.0 - 9.0.1. An attacker can exploit this vulnerability to smuggle requests via invalid...

PT-2021-3573

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 7.0.0 through 7.1.12 Apache Traffic Server versions 8.0.0 through 8.1.1 Apache Traffic Server versions 9.0.0 through 9.0.1 Description The issue is caused by improper input validation in the HTTP/2 component of...

PT-2021-3575

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 7.0.0 through 7.1.12 Apache Traffic Server versions 8.0.0 through 8.1.1 Apache Traffic Server versions 9.0.0 through 9.0.1 Description The issue is related to invalid values in the Content-Length header sent to...

PT-2021-3574

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 7.0.0 through 7.1.12 Apache Traffic Server versions 8.0.0 through 8.1.1 Apache Traffic Server versions 9.0.0 through 9.0.1 Description The issue is caused by a stack-based buffer overflow in the cachekey plugin o...

PT-2021-3576

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 7.0.0 through 7.1.12 Apache Traffic Server versions 8.0.0 through 8.1.1 Apache Traffic Server versions 9.0.0 through 9.0.1 Description The issue is related to the incorrect handling of the URL fragment in Apache...

Node.js: HTTP Request Smuggling due to ignoring chunk extensions

Summary: The llhttp parser in the http module in Node 16.3.0 ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling HRS when a Node server is put behind an Apache Traffic Server ATS 9.0.0 proxy. Description: In the chunked transfer encoding format...

Apache Traffic Server (ATS) 9.0.0 DoS Vulnerability

Apache Traffic Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2021-27737

Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin...

CVE-2021-27737

Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin...

Code injection

Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin...