{"id":"CVE-2020-9494","published":"2020-06-24T15:25:57Z","modified":"2024-08-04T10:34:37Z","title":"Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2…","vendor":"Apache","product":"Apache Traffic Server","tier":"tail","description":{"text":"Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0358,"percentile":0.89363,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/rf7f86917f42fdaf904d99560cba0c016e03baea6244c47efeb60ecbe%40%3Cdev.trafficserver.apache.org%3E","tags":["x_refsource_CONFIRM"]},{"url":"https://www.debian.org/security/2020/dsa-4710","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/01/2","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":17.9,"factors":[{"name":"EPSS percentile","points":17.87}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Traffic Server","versions":["6.0.0 to 6.2.3","7.0.0 to 7.1.10","8.0.0 to 8.0.7"]}],"euvd":{"id":"EUVD-2020-30301","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-traffic-server-cve-2009-2693","children":[{"from":"CVE-2020-9494","to":"CVE-2021-25329","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494.","from":"CVE.org","in":"CVE-2021-25329"}]}]}}