{"id":"CVE-2021-27577","aliases":["DEBIAN-CVE-2021-27577","DSA-4957-1","EUVD-2021-14326","GHSA-m6m2-j477-jfg8","UBUNTU-CVE-2021-27577"],"status":"published","title":"Incorrect handling of url fragment leads to cache poisoning","description":"Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03447,"percentile":0.89108,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2021-06-29T11:45:19Z","modified":"2026-10-24T10:30:29Z","fixes":[{"ecosystem":"Debian:12","package":"trafficserver","fixed_in":["8.1.1+ds-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1+ds-1.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2+ds-1+deb10u5"}]}],"versions":["8.0.2+ds-1","8.0.2+ds-1+deb10u1","8.0.2+ds-1+deb10u2","8.0.2+ds-1+deb10u3","8.0.2+ds-1+deb10u4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-5","7.1.2+ds-2","7.1.2+ds-2build1","7.1.2+ds-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.5+ds-1","8.0.5+ds-2","8.0.5+ds-2build1","8.0.5+ds-2ubuntu1","8.0.5+ds-3","8.0.5+ds-3ubuntu0.1~esm1"]}],"products":[{"vendor":"apache","product":"traffic_server"},{"vendor":"apache software foundation","product":"apache traffic server"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://lists.apache.org/thread.html/ra1a41ff92a70d25bf576d7da2590575e8ff430393a3f4a0c34de4277%40%3Cusers.trafficserver.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4957","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27577"},{"url":"https://github.com/advisories/GHSA-m6m2-j477-jfg8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-27577","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-27577","tags":["report"]},{"url":"https://lists.apache.org/thread.html/ra1a41ff92a70d25bf576d7da2590575e8ff430393a3f4a0c34de4277%40%3Cannounce.trafficserver.apache.org%3E","tags":["report"]},{"url":"https://github.com/apache/trafficserver/pull/7945","tags":["report"]},{"url":"https://github.com/apache/trafficserver/commit/2b13eb33794574e62249997b4ba654d943a10f2d","tags":["report"]},{"url":"https://github.com/apache/trafficserver/commit/b82a3d192f995fb9d78e1c44d51d9acca4783277","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-27577","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-27577","title":"Incorrect handling of url fragment leads to cache poisoning","description":"Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.","status":"published","published":"2021-06-29T11:45:19Z","modified":"2024-08-03T21:26:09.764Z","cwes":["CWE-444"],"updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-14326","description":"Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.","status":"published","published":"2021-06-29T11:45:19Z","modified":"2024-08-03T21:26:09Z","updated_at":"2026-11-03T03:24:48.919164Z"}],"ghsa":[{"id":"GHSA-m6m2-j477-jfg8","title":"Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to...","description":"Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.","status":"published","published":"2022-05-24T19:06:34Z","modified":"2023-01-30T05:00:35Z","cwes":["CWE-444"],"updated_at":"2026-11-02T14:46:14.069279Z"}],"nvd":[{"id":"CVE-2021-27577","description":"Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.","status":"published","published":"2021-06-29T12:15:08.437Z","modified":"2026-06-17T03:45:09.77Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:06:55.259633Z"}],"osv":[{"id":"CVE-2021-27577","description":"Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.","status":"published","published":"2021-06-29T12:15:08.437Z","modified":"2026-10-24T10:30:29.985922407Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-27577","description":"Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.","status":"published","published":"2021-06-29T12:15:08.437Z","modified":"2026-10-23T18:03:25.741036238Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"UBUNTU-CVE-2021-27577","description":"Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.","status":"published","published":"2021-06-29T12:15:00Z","modified":"2026-04-22T12:49:42.407487Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"DSA-4957-1","title":"trafficserver - security update","status":"published","published":"2021-08-13T00:00:00Z","modified":"2026-03-09T02:09:06.416343Z","updated_at":"2026-11-02T15:46:17.19998Z"}]}}