Unscored CVE-2016-5396 EUVD-2016-6342GHSA-4r32-4xgr-6w96

Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.

Published Apr 17, 2017 · Updated Aug 6, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Traffic Server Package: trafficserver Ecosystem: Debian

Description

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Traffic Server	6.0.0 to 6.2.0	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 12	trafficserver	7.0.0-1	—

References

https://issues.apache.org/jira/browse/TS-5019
97945 vdb-entry
1038275 vdb-entry