CVE-2021-37147: apache software foundation apache traffic server Improper Input Validation
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2021-37147DEBIAN-CVE-2021-37147
Published 03-11-2021Last modified 04-08-2024
Vulnerability summary
CVE-2021-37147 is a high (CVSS 7.5) Improper Input Validation vulnerability in apache software foundation apache traffic server. EPSS estimates a 2.52% chance of exploitation in the next 30 days, higher than 84.5% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
2.52%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 03-11-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.52%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.52% on 18-09-2026
18-09-202618-10-2026
EPSS score2.52%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Affected systems
Debian2 products
- trafficserver< 9.1.1+ds-1
- debian_linuxEOL10.0 | 11.0
Apache1 product
- traffic_server≥ 8.0.0, ≤ 8.1.2 | ≥ 9.0.0, ≤ 9.1.0
Apache software foundation1 product
- apache traffic server8.0.0 to 8.1.2 and 9.0.0 to 9.1.0
Ubuntu1 product
- trafficserverAll versions (No fix recorded)
4 vendors · 5 products
References
9 links- lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164X Refsource MISCMailing ListPatchVendor Advisory
