{"id":"CVE-2021-44040","aliases":["DEBIAN-CVE-2021-44040","DSA-5153-1","EUVD-2021-30899","GHSA-6h7p-g96p-26q3","OESA-2022-1692","UBUNTU-CVE-2021-44040"],"status":"published","title":"HTTP request line fuzzing attacks","description":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01991,"percentile":0.80836,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2022-03-23T14:05:15Z","modified":"2026-10-24T10:30:40Z","fixes":[{"ecosystem":"Debian:12","package":"trafficserver","fixed_in":["9.1.2+ds-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"trafficserver","fixed_in":["9.1.2-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"trafficserver","fixed_in":["9.1.2-1.oe1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2+ds-1+deb10u6"}]}],"versions":["8.0.2+ds-1","8.0.2+ds-1+deb10u1","8.0.2+ds-1+deb10u2","8.0.2+ds-1+deb10u3","8.0.2+ds-1+deb10u4","8.0.2+ds-1+deb10u5"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1+ds-1.1+deb11u1"}]}],"versions":["8.1.1+ds-1.1"],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.2-1.oe1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-5","7.1.2+ds-2","7.1.2+ds-2build1","7.1.2+ds-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.5+ds-1","8.0.5+ds-2","8.0.5+ds-2build1","8.0.5+ds-2ubuntu1","8.0.5+ds-3","8.0.5+ds-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.1.1+ds-1.1","9.1.1+ds-2build1","9.1.1+ds-2ubuntu0.1~esm1","9.1.1+ds-2ubuntu0.1","9.1.1+ds-2ubuntu0.1+esm1"]}],"products":[{"vendor":"apache","product":"traffic_server"},{"vendor":"apache software foundation","product":"apache traffic server"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://lists.apache.org/thread/zblwzcfs9ryhwjr89wz4osw55pxm6dx6","tags":["x_refsource_MISC","x_transferred","Mailing List","Vendor Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2022/dsa-5153","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44040","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6h7p-g96p-26q3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-44040","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1692","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-44040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44040","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-44040","title":"HTTP request line fuzzing attacks","description":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.","status":"published","published":"2022-03-23T14:05:15Z","modified":"2024-08-04T04:10:17.217Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-30899","description":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.","status":"published","published":"2022-03-23T14:05:15Z","modified":"2024-08-04T04:10:17Z","updated_at":"2026-11-03T03:24:12.599691Z"}],"ghsa":[{"id":"GHSA-6h7p-g96p-26q3","title":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows...","description":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.","status":"published","published":"2022-03-24T00:00:21Z","modified":"2023-01-27T05:01:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:41:47.978566Z"}],"nvd":[{"id":"CVE-2021-44040","description":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.","status":"published","published":"2022-03-23T14:15:07.717Z","modified":"2026-06-17T04:11:50.16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:05.581807Z"}],"osv":[{"id":"CVE-2021-44040","description":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.","status":"published","published":"2022-03-23T14:15:07.717Z","modified":"2026-10-24T10:30:40.836759473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"DEBIAN-CVE-2021-44040","description":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.","status":"published","published":"2022-03-23T14:15:07.717Z","modified":"2026-10-23T18:04:00.439451497Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"OESA-2022-1692","title":"trafficserver security update","description":"Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.\r\n\r\nSecurity Fix(es):\r\n\r\nImproper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.(CVE-2021-44040)","status":"published","published":"2022-06-02T11:04:58Z","modified":"2026-08-18T01:16:41.160688324Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-44040","description":"Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.","status":"published","published":"2022-03-23T14:15:00Z","modified":"2026-04-22T13:02:50.298917Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"DSA-5153-1","title":"trafficserver - security update","status":"published","published":"2022-05-30T00:00:00Z","modified":"2026-03-09T02:08:42.579445Z","updated_at":"2026-11-02T15:46:17.543497Z"}]}}