Medium DLA-3279-1 4 CVEs

trafficserver - security update

Published Jan 23, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 10	trafficserver	8.0.2+ds-1+deb10u7

Vulnerabilities 4

Medium 6.8

CVE-2022-25763

Improper input validation on HTTP/2 headers

Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Aug 10, 2022
Medium 4.2

CVE-2021-37150

Protocol vs scheme mismatch

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Aug 10, 2022
Unscored —

CVE-2022-28129

Insufficient Validation of HTTP/1.x Headers

Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Aug 10, 2022
Unscored —

CVE-2022-31780

HTTP/2 framing vulnerabilities

Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Aug 10, 2022