CVE-2024-38479

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper Input Validation vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5.

Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Apache Software FoundationApache Traffic Server>= 8.0.0, <= 8.1.11; >= 9.0.0, <= 9.2.5
apache_software_foundationapache_traffic_server>= 8.0.0, <= 8.1.11; >= 9.0.0, <= 9.2.5

References

Timeline

Published
Nov 14, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-38487.5A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. ThCVE-2024-384804.0"Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attackCVE-2024-384814.4Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Read Vulnerability. A privileged local attacker could execute arCVE-2024-384827.2CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component. A higCVE-2024-384836.7Dell BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local acCVE-2024-384854.3Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially explCVE-2024-384868.8Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special ElemenCVE-2024-384877.0api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintendCVE-2024-384889.8Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability wheCVE-2024-384894.4Dell iDRAC Service Module version 5.3.0.0 and prior contains Out of bound write Vulnerability. A privileged local attacker could execute arbCVE-2024-38498.8The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This mCVE-2024-384904.4Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. A privileged local attacker could execute a
CVE-2024-38479: High severity, CVSS 7.5 | Vulnix