Summary
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen HTTP/2 Server Implementierungen wie dem Apache Traffic Server ausnutzen, um einen Denial of Service Angriff durchzuführen.
Product
Apache Traffic Server ist ein skalier- und erweiterbarer, mit HTTP/1.1 kompatibler "caching proxy server".
Vulnerabilities 1
-
High 7.5
Apache Traffic Server: DoS vulnerability in HTTP/2 via stalled flow-control conditions
Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2. Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue.
Revision history
-
#2
Neue Updates von Fedora und European Union Vulnerability Database aufgenommen
-
#1
Initiale Fassung
References
-
CERT/CC VU#885548: Denial-of-service vulnerability in HTTP/2 servers via stalled flow-control conditions vom 2026-07-16
https://kb.cert.org/vuls/id/885548
-
OSS Security: Apache Traffic Server is vulnerable to stalled HTTP/2 flow-control vom 2026-07-16
https://seclists.org/oss-sec/2026/q3/162
-
Fedora Security Advisory FEDORA-EPEL-2026-6B5CEC4A03 vom 2026-07-19
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-6b5cec4a03
-
Fedora Security Advisory FEDORA-2026-DDAABE38AB vom 2026-07-19
https://bodhi.fedoraproject.org/updates/FEDORA-2026-ddaabe38ab
-
Fedora Security Advisory FEDORA-2026-BB8DC1E5B6 vom 2026-07-19
https://bodhi.fedoraproject.org/updates/FEDORA-2026-bb8dc1e5b6
-
Fedora Security Advisory FEDORA-EPEL-2026-5BCB271BEE vom 2026-07-19
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-5bcb271bee