Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-17565: Apache Traffic Server can be tricked into request smuggling
CVE-2019-17565 · published 6 years ago
Summary
Versions of Apache Traffic Server from 6.0.0 through 8.0.5 can be fooled by specially crafted web traffic, causing it to misinterpret and forward malicious requests. This could let attackers bypass security controls or deliver harmful content. Upgrade to Apache Traffic Server 7.1.9, 8.0.6, or any newer release to close the gap.
What to do
- Update debian trafficserver to version 8.0.6+ds-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | trafficserver |
< 8.0.6+ds-1 Fix: upgrade to 8.0.6+ds-1
|
| – | apache | traffic_server |
>= 6.0.0, <= 6.2.3 >= 7.0.0, <= 7.1.8 >= 8.0.0, <= 8.0.5 cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
Original advisory text
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to versions 7.1.9 and 8.0.6 or later versi...
There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
References
- https://security-tracker.debian.org/tracker/CVE-2019-17565 Vendor Advisory
- https://lists.apache.org/thread.html/r99d18d0bc4daa05e7d0e5a63e0e22701a421b2ef5a... Mailing List Vendor Advisory
- https://www.debian.org/security/2020/dsa-4672 Third Party Advisory
Severity
9.8
Critical
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Timeline
Published23 Mar 2020
Updated31 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta