CVE-2024-38479

7.5 highEPSS 0.8%

High (7.5) in apache traffic server. EPSS 0.8% chance of exploitation in the next 30 days.

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2024-11-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:traffic_server

References

https://lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y
https://lists.debian.org/debian-lts-announce/2025/02/msg00018.html

Check your stack JSON