CVE-2024-38479
Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
CVE-2024-38479- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2024-37359
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
EUVD-2024-37359- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c43q-432c-pfx8
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache...
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
GHSA-c43q-432c-pfx8- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
CVE-2024-38479- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-38479
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
ALPINE-CVE-2024-38479- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSV
Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack
Improper Input Validation vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
CVE-2024-38479- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2024-38479
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
DEBIAN-CVE-2024-38479- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2024-2470
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.(CVE-2024-38479)
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.(CVE-2024-50305)
Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the issue.(CVE-2024-50306)
- Record
OESA-2024-2470- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-1019
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Improper Input Validation vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.(CVE-2024-38479)
Valid Host header field can cause Apache Traffic Server to crash on some platforms.
This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5.
Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.(CVE-2024-50305)
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted.Users can use a new setting for the plugin (--max-inclusion-depth) to limit it.This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10.Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fixes the issue.(CVE-2025-49763)
- Record
OESA-2026-1019- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-38479
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Record
UBUNTU-CVE-2024-38479- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trafficserver9Alpine:v3.21 |
before 9.2.6-r0 | 9.2.6-r0 |
trafficserver9Alpine:v3.22 |
before 9.2.6-r0 | 9.2.6-r0 |
trafficserver9Alpine:v3.23 |
before 9.2.6-r0 | 9.2.6-r0 |
trafficserver9Alpine:v3.24 |
before 9.2.6-r0 | 9.2.6-r0 |
trafficserverDebian:12 |
before 9.2.5+ds-0+deb12u2, plus listed versions 9.2.0+ds-29.2.0+ds-2+deb12u19.2.1+ds-19.2.2+ds-19.2.3+ds-1 Show 5 moreShow less9.2.3+ds-1+deb12u19.2.4+ds-0+deb12u19.2.4+ds-19.2.4+ds-29.2.5+ds-0+deb12u1 |
9.2.5+ds-0+deb12u2 |
trafficserverDebian:11 From an advisory covering 2 CVEs |
before 8.1.11+ds-0+deb11u2, plus listed versions 8.1.1+ds-1.18.1.1+ds-1.1+deb11u18.1.10+ds-1~deb11u18.1.11+ds-0+deb11u18.1.5+ds-1~deb11u1 Show 4 moreShow less8.1.6+ds-1~deb10u18.1.6+ds-1~deb11u18.1.7+ds-1~deb11u18.1.9+ds-1~deb11u1 |
8.1.11+ds-0+deb11u2 |
trafficserverDebian:12 From an advisory covering 6 CVEs |
before 9.2.5+ds-0+deb12u2, plus listed versions 9.2.0+ds-29.2.0+ds-2+deb12u19.2.1+ds-19.2.2+ds-19.2.3+ds-1 Show 5 moreShow less9.2.3+ds-1+deb12u19.2.4+ds-0+deb12u19.2.4+ds-19.2.4+ds-29.2.5+ds-0+deb12u1 |
9.2.5+ds-0+deb12u2 |
trafficserveropenEuler:24.03-LTS From an advisory covering 3 CVEs |
before 9.2.5-2.oe2403 | 9.2.5-2.oe2403 |
trafficserveropenEuler:20.03-LTS-SP4 From an advisory covering 3 CVEs |
before 9.1.4-5.oe2003sp4 | 9.1.4-5.oe2003sp4 |
trafficserverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 8.0.5+ds-18.0.5+ds-28.0.5+ds-2build18.0.5+ds-2ubuntu18.0.5+ds-38.0.5+ds-3ubuntu0.1~esm1 |
None known |
trafficserverUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 8.1.1+ds-1.19.1.1+ds-2build19.1.1+ds-2ubuntu0.1~esm19.1.1+ds-2ubuntu0.19.1.1+ds-2ubuntu0.1+esm1 |
None known |
trafficserverUbuntu:24.04:LTS |
All versions, plus listed versions 9.2.1+ds-1build19.2.2+ds-19.2.3+ds-19.2.3+ds-1+deb12u19.2.3+ds-1+deb12u1build19.2.3+ds-1+deb12u1build39.2.3+ds-1+deb12u1build49.2.3+ds-1+deb12u1ubuntu0.1 |
None known |
trafficserverUbuntu:25.10 |
All versions, plus listed versions 9.2.5+ds-1ubuntu19.2.5+ds-1ubuntu29.2.5+ds-1ubuntu2.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-38479 is a high vulnerability (CVSS 7.5) in Apache Traffic Server, published November 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in trafficserver9 9.2.6-r0.
References
lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y
lists.debian.org/debian-lts-announce/2025/02/msg00018.html
nvd.nist.gov/vuln/detail/CVE-2024-38479
github.com/advisories/GHSA-c43q-432c-pfx8
security.alpinelinux.org/vuln/CVE-2024-38479
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2024-38479
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2470
ubuntu.com/security/CVE-2024-38479
cve.org/CVERecord?id=CVE-2024-38479
openwall.com/lists/oss-security/2024/11/13/1