CVE-2022-31780
HTTP/2 framing vulnerabilities
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
CVE-2022-31780- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
HTTP/2 framing vulnerabilities
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
CVE-2022-31780- Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2022-53173 No score
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
EUVD-2022-53173- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3jf9-4x8h-72mh
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows...
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
GHSA-3jf9-4x8h-72mh- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-31780
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
UBUNTU-CVE-2022-31780- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV No score
HTTP/2 framing vulnerabilities
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
CVE-2022-31780- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-31780 No score
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
- Record
DEBIAN-CVE-2022-31780- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trafficserverDebian:12 |
before 9.1.3+ds-1 | 9.1.3+ds-1 |
trafficserverDebian:10 From an advisory covering 4 CVEs |
before 8.0.2+ds-1+deb10u7, plus listed versions 8.0.2+ds-18.0.2+ds-1+deb10u18.0.2+ds-1+deb10u28.0.2+ds-1+deb10u38.0.2+ds-1+deb10u48.0.2+ds-1+deb10u58.0.2+ds-1+deb10u6 |
8.0.2+ds-1+deb10u7 |
trafficserverDebian:11 From an advisory covering 6 CVEs |
before 8.1.5+ds-1~deb11u1, plus listed versions 8.1.1+ds-1.18.1.1+ds-1.1+deb11u1 |
8.1.5+ds-1~deb11u1 |
trafficserverUbuntu:16.04:LTS |
All versions, plus listed versions 5.3.0-2ubuntu15.3.0-2ubuntu2 |
None known |
trafficserverUbuntu:18.04:LTS |
All versions, plus listed versions 7.0.0-57.1.2+ds-27.1.2+ds-2build17.1.2+ds-3 |
None known |
trafficserverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 8.0.5+ds-18.0.5+ds-28.0.5+ds-2build18.0.5+ds-2ubuntu18.0.5+ds-38.0.5+ds-3ubuntu0.1~esm1 |
None known |
trafficserverUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 8.1.1+ds-1.19.1.1+ds-2build19.1.1+ds-2ubuntu0.1~esm19.1.1+ds-2ubuntu0.19.1.1+ds-2ubuntu0.1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31780 is a high vulnerability (CVSS 7.5) in Apache Traffic Server, published August 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.48%, the 84th percentile. Fixed in trafficserver 9.1.3+ds-1.
References
lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21
debian.org/security/2022/dsa-5206
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J
lists.debian.org/debian-lts-announce/2023/01/msg00019.html
nvd.nist.gov/vuln/detail/CVE-2022-31780
Show 7 moreShow less
github.com/advisories/GHSA-3jf9-4x8h-72mh
security-tracker.debian.org/tracker/CVE-2022-31780
ubuntu.com/security/CVE-2022-31780
cve.org/CVERecord?id=CVE-2022-31780