CVE-2018-8005
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the...
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
- Record
CVE-2018-8005- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
- Record
CVE-2018-8005- Updated
- 2026-11-02
EUVDEUVD-2018-19717 No score
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
- Record
EUVD-2018-19717- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-98hg-h5w7-368p
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the...
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
- Record
GHSA-98hg-h5w7-368p- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
- Record
CVE-2018-8005- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-8005
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
- Record
DEBIAN-CVE-2018-8005- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-8005
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.
- Record
UBUNTU-CVE-2018-8005- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trafficserverDebian:12 |
before 7.1.4+ds-1 | 7.1.4+ds-1 |
trafficserverDebian:9 From an advisory covering 4 CVEs |
before 7.0.0-6+deb9u2, plus listed versions 7.0.0-57.0.0-6+deb9u1 |
7.0.0-6+deb9u2 |
trafficserverUbuntu:16.04:LTS |
All versions, plus listed versions 5.3.0-2ubuntu15.3.0-2ubuntu2 |
None known |
trafficserverUbuntu:18.04:LTS |
All versions, plus listed versions 7.0.0-57.1.2+ds-27.1.2+ds-2build17.1.2+ds-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-8005 is a medium vulnerability (CVSS 5.3) in Apache Traffic Server, published August 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.81%, the 94th percentile. Fixed in trafficserver 7.1.4+ds-1.
References
lists.apache.org/thread.html/55d225af92887bfed0194400fd1b718622cca4140fc7318d982e25ca%40%3Cusers.trafficserver.apache.org%3E
debian.org/security/2018/dsa-4282
securityfocus.com/bid/105187
github.com/apache/trafficserver/pull/3106
nvd.nist.gov/vuln/detail/CVE-2018-8005
Show 7 moreShow less
security-tracker.debian.org/tracker/CVE-2018-8005
ubuntu.com/security/CVE-2018-8005
openwall.com/lists/oss-security/2018/08/29/4
cve.org/CVERecord?id=CVE-2018-8005