CVE-2021-37147

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20 CWE-444

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Traffic Server	8.0.0 to 8.1.2 and 9.0.0 to 9.1.0

References

https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164Mailing List, Patch, Vendor Advisory
https://www.debian.org/security/2022/dsa-5153Third Party Advisory
https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164Mailing List, Patch, Vendor Advisory
https://www.debian.org/security/2022/dsa-5153Third Party Advisory

Timeline

Published: Nov 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-371487.5Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affect CVE-2021-371497.5Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affect CVE-2021-37157.8A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled chang CVE-2021-371507.5Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issu CVE-2021-371515.3CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain aut CVE-2021-371525.4Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML files CVE-2021-371539.8ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass iss CVE-2021-371549.8In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 CVE-2021-371559.8wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the seria CVE-2021-371567.5Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the int CVE-2021-371578.8An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. $HOME/OGP/Cfg/Config.pm has the root password in cleartext.CVE-2021-371588.8An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. An authenticated attacker could inject OS commands by starting