PT-2024-9209 · Apache+1 · Apache Traffic Server+1

Bryan Call · Published 2024-11-12 · Updated 2026-01-09 · CVE-2024-38479

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.5

Description: The issue is related to improper input validation, which can allow a remote attacker to implement a cache poisoning attack. This is a result of insufficient checking of input data.

Recommendations: For versions 8.0.0 through 8.1.11, upgrade to version 9.2.6 or 10.0.2 to fix the issue. For versions 9.0.0 through 9.2.5, upgrade to version 9.2.6 or 10.0.2 to fix the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-10897

CVE-2024-38479

DLA-4055-1

DSA-5896-1

OESA-2024-2470

OESA-2026-1019

Affected Products

Apache Traffic Server

Debian

References · 36

• https://nvd.nist.gov/vuln/detail/CVE-2024-50305 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38479 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38479 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-38479 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-38479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49763 · Security Note
• https://osv.dev/vulnerability/DLA-4055-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10897 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1019 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5896-1 · Vendor Advisory
• https://lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-38479 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-38479 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50306 · Security Note