Description
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Traffic Server | 6.2.0 and prior, 7.0.0 and prior | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | trafficserver | 7.1.2+ds-1 | — |
| Debian 9 | trafficserver | 7.0.0-6+deb9u1 | DSA-4128-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | trafficserver | No fix yet | — |
Advisories 1
- DSA-4128-1 trafficserver - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-4128 vendor-advisory
- [dev] 20180227 [ANNOUNCE] Apache Traffic Server host header and line folding - CVE-2017-5660 mailing-list