CVE-2021-43082

9.8 criticalEPSS 2.4%

Critical (9.8) in apache traffic server. EPSS 2.4% chance of exploitation in the next 30 days.

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.4% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-120
Published: 2021-11-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:traffic_server

References

https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164
https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164

Check your stack JSON