CVE-2024-50305
Apache Traffic Server: Valid Host field value can cause crashes
Valid Host header field can cause Apache Traffic Server to crash on some platforms.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Traffic Server: Valid Host field value can cause crashes
Valid Host header field can cause Apache Traffic Server to crash on some platforms.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
CVE-2024-50305- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2024-44805
Valid Host header field can cause Apache Traffic Server to crash on some platforms.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
EUVD-2024-44805- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-45gh-j7vr-755q
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue...
Valid Host header field can cause Apache Traffic Server to crash on some platforms.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
GHSA-45gh-j7vr-755q- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-120
- Updated
- 2026-11-02
NVD
Valid Host header field can cause Apache Traffic Server to crash on some platforms.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
CVE-2024-50305- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-120
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-50305
Valid Host header field can cause Apache Traffic Server to crash on some platforms.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
ALPINE-CVE-2024-50305- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
Apache Traffic Server: Valid Host field value can cause crashes
Valid Host header field can cause Apache Traffic Server to crash on some platforms.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
CVE-2024-50305- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2024-50305
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
DEBIAN-CVE-2024-50305- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-2470
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.(CVE-2024-38479)
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.(CVE-2024-50305)
Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the issue.(CVE-2024-50306)
- Record
OESA-2024-2470- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-1019
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Improper Input Validation vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.(CVE-2024-38479)
Valid Host header field can cause Apache Traffic Server to crash on some platforms.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.(CVE-2024-50305)
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.Users can use a new setting for the plugin (--max-inclusion-depth) to limit it.This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.(CVE-2025-49763)
- Record
OESA-2026-1019- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-50305
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
UBUNTU-CVE-2024-50305- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-8050-1 No score
trafficserver vulnerability
Masakazu Kitajo discovered that Apache Traffic Server did not properly handle the Valid Host header field. An attacker could possibly use this issue to cause a denial of service (DoS).
- Record
USN-8050-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trafficserver9Alpine:v3.21 |
before 9.2.6-r0 | 9.2.6-r0 |
trafficserver9Alpine:v3.22 |
before 9.2.6-r0 | 9.2.6-r0 |
trafficserver9Alpine:v3.23 |
before 9.2.6-r0 | 9.2.6-r0 |
trafficserver9Alpine:v3.24 |
before 9.2.6-r0 | 9.2.6-r0 |
trafficserverDebian:12 |
before 9.2.5+ds-0+deb12u2, plus listed versions 9.2.0+ds-29.2.0+ds-2+deb12u19.2.1+ds-19.2.2+ds-19.2.3+ds-1 Show 5 moreShow less9.2.3+ds-1+deb12u19.2.4+ds-0+deb12u19.2.4+ds-19.2.4+ds-29.2.5+ds-0+deb12u1 |
9.2.5+ds-0+deb12u2 |
trafficserverDebian:12 From an advisory covering 6 CVEs |
before 9.2.5+ds-0+deb12u2, plus listed versions 9.2.0+ds-29.2.0+ds-2+deb12u19.2.1+ds-19.2.2+ds-19.2.3+ds-1 Show 5 moreShow less9.2.3+ds-1+deb12u19.2.4+ds-0+deb12u19.2.4+ds-19.2.4+ds-29.2.5+ds-0+deb12u1 |
9.2.5+ds-0+deb12u2 |
trafficserveropenEuler:24.03-LTS From an advisory covering 3 CVEs |
before 9.2.5-2.oe2403 | 9.2.5-2.oe2403 |
trafficserveropenEuler:20.03-LTS-SP4 From an advisory covering 3 CVEs |
before 9.1.4-5.oe2003sp4 | 9.1.4-5.oe2003sp4 |
trafficserverUbuntu:22.04:LTS |
before 9.1.1+ds-2ubuntu0.1, plus listed versions 8.1.1+ds-1.19.1.1+ds-2build1 |
9.1.1+ds-2ubuntu0.1 |
trafficserverUbuntu:24.04:LTS |
before 9.2.3+ds-1+deb12u1ubuntu0.1, plus listed versions 9.2.1+ds-1build19.2.2+ds-19.2.3+ds-19.2.3+ds-1+deb12u19.2.3+ds-1+deb12u1build19.2.3+ds-1+deb12u1build39.2.3+ds-1+deb12u1build4 |
9.2.3+ds-1+deb12u1ubuntu0.1 |
trafficserverUbuntu:25.10 |
before 9.2.5+ds-1ubuntu2.1, plus listed versions 9.2.5+ds-1ubuntu19.2.5+ds-1ubuntu2 |
9.2.5+ds-1ubuntu2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-50305 is a high vulnerability (CVSS 7.5) in Apache Traffic Server, published November 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in trafficserver9 9.2.6-r0.
References
lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y
nvd.nist.gov/vuln/detail/CVE-2024-50305
github.com/advisories/GHSA-45gh-j7vr-755q
security.alpinelinux.org/vuln/CVE-2024-50305
security-tracker.debian.org/tracker/CVE-2024-50305
Show 12 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2470
ubuntu.com/security/CVE-2024-50305
cve.org/CVERecord?id=CVE-2024-50305
openwall.com/lists/oss-security/2024/11/13/1