CyberRota Analysis
AI-GeneratedApache Traffic Server versions 8.0.0 through 10.1.3 are vulnerable to a memory exhaustion attack due to improper handling of HTTP/2 and HTTP/3 responses, allowing slow clients to bypass the per-stream buffer limit. This vulnerability can lead to significant server resource depletion, impacting service availability. Organizations using affected versions should prioritize upgrading to versions 9.2.15 or 10.1.4 to mitigate this risk.
Original NVD Description
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)