CVE-2021-37150
Protocol vs scheme mismatch
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
CVE-2021-37150- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List
Protocol vs scheme mismatch
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
CVE-2021-37150- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2021-23724
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
EUVD-2021-23724- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qp2r-xr6f-7jm8
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an...
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
GHSA-qp2r-xr6f-7jm8- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
CVE-2021-37150- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-37150
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
DEBIAN-CVE-2021-37150- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-37150
Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
UBUNTU-CVE-2021-37150- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trafficserverDebian:12 |
before 9.1.3+ds-1 | 9.1.3+ds-1 |
trafficserverDebian:10 From an advisory covering 4 CVEs |
before 8.0.2+ds-1+deb10u7, plus listed versions 8.0.2+ds-18.0.2+ds-1+deb10u18.0.2+ds-1+deb10u28.0.2+ds-1+deb10u38.0.2+ds-1+deb10u48.0.2+ds-1+deb10u58.0.2+ds-1+deb10u6 |
8.0.2+ds-1+deb10u7 |
trafficserverDebian:11 From an advisory covering 6 CVEs |
before 8.1.5+ds-1~deb11u1, plus listed versions 8.1.1+ds-1.18.1.1+ds-1.1+deb11u1 |
8.1.5+ds-1~deb11u1 |
trafficserverUbuntu:16.04:LTS |
All versions, plus listed versions 5.3.0-2ubuntu15.3.0-2ubuntu2 |
None known |
trafficserverUbuntu:18.04:LTS |
All versions, plus listed versions 7.0.0-57.1.2+ds-27.1.2+ds-2build17.1.2+ds-3 |
None known |
trafficserverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 8.0.5+ds-18.0.5+ds-28.0.5+ds-2build18.0.5+ds-2ubuntu18.0.5+ds-38.0.5+ds-3ubuntu0.1~esm1 |
None known |
trafficserverUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 8.1.1+ds-1.19.1.1+ds-2build19.1.1+ds-2ubuntu0.1~esm19.1.1+ds-2ubuntu0.19.1.1+ds-2ubuntu0.1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-37150 is a high vulnerability (CVSS 7.5) in Apache Traffic Server, published August 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.25%, the 83rd percentile. Fixed in trafficserver 9.1.3+ds-1.
References
lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21
debian.org/security/2022/dsa-5206
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J
lists.debian.org/debian-lts-announce/2023/01/msg00019.html
nvd.nist.gov/vuln/detail/CVE-2021-37150
Show 6 moreShow less
github.com/advisories/GHSA-qp2r-xr6f-7jm8
security-tracker.debian.org/tracker/CVE-2021-37150
ubuntu.com/security/CVE-2021-37150
cve.org/CVERecord?id=CVE-2021-37150