CVE-2018-8005: apache software foundation apache traffic server Uncontrolled Resource Consumption

EPSS trend

Probability

6.89%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 6.89% on 18-09-2026

18-09-202618-10-2026

EPSS score

6.89%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

10 links

lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.debian.org/security/2018/dsa-4282Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.securityfocus.com/bid/105187VDB EntryX Refsource BIDThird Party Advisory
github.com/apache/trafficserver/pull/3106X Refsource CONFIRMThird Party AdvisoryREPORT
github.com/apache/trafficserver/pull/3124X Refsource CONFIRMThird Party AdvisoryREPORT
ubuntu.com/security/CVE-2018-8005REPORT
www.openwall.com/lists/oss-security/2018/08/29/4REPORT
github.com/apache/trafficserver/commit/bbcbb7cf7f25ebfe3a97d792e889de618e41a6a4REPORT
www.cve.org/CVERecord?id=CVE-2018-8005REPORT
security-tracker.debian.org/tracker/CVE-2018-8005Advisory

Related vulnerabilities

CVE-2018-1318apache software foundationapache traffic server+47.72%8y ago29-08-2018 13:00Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.CVE-2018-19200debianuriparser+32.48%7y ago12-11-2018 15:00An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.CVE-2018-11783apache software foundationapache traffic server+31.87%7y ago07-03-2019 18:00sslheaders plugin extracts information from the client certificate and sets headers in the request based on the configuration of the plugin. The plugin doesn't strip the headers from the request in some scenarios. This problem was discovered in versions 6.0.0 to 6.0.3, 7.0.0 to 7.1.5, and 8.0.0 to 8.0.1.CVE-2018-9481apachetraffic_server+10.14%1y ago20-11-2024 17:40In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation.CVE-2018-8004apache software foundationapache traffic server+46.31%8y ago29-08-2018 13:00There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.CVE-2018-8022apache software foundationapache traffic server+37.50%8y ago29-08-2018 13:00A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions.

All vulnerabilities inapache traffic server traffic_server debian_linux

CVE-2018-8005: apache software foundation apache traffic server Uncontrolled Resource Consumption

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References