CVE-2019-10079

State: Published
Severity: Not scored
Published: Oct 22, 2019
Updated: Aug 4, 2024
Reserved: Mar 26, 2019

Description

Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't limit the number of setting frames sent from the client using the HTTP/2 protocol. Users should upgrade to Apache Traffic Server 7.1.7, 8.0.4, or later versions.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Apache Traffic Servern/a	Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.6, and 8.0.0 to 8.0.3Affected

References

[trafficserver-dev] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacksmailing-list
[trafficserver-users] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacksmailing-list
[trafficserver-announce] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacksmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.