CVE-2024-50305

Name	CVE-2024-50305
Description	Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-5896-1
Debian Bugs	1087531

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
trafficserver (PTS)	bookworm, bookworm (security)	9.2.5+ds-0+deb12u4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
trafficserver	source	bookworm	9.2.5+ds-0+deb12u2		DSA-5896-1
trafficserver	source	(unstable)	(unfixed)			1087531

Notes

https://www.openwall.com/lists/oss-security/2024/11/13/1
https://github.com/apache/trafficserver/issues/8461
https://github.com/apache/trafficserver/commit/5e39658f7c0bc91613468c9513ba22ede1739d7e (9.2.6-rc0)
https://github.com/apache/trafficserver/commit/055ca11c2842a64bf7df8d547515670e1a04afc1 (master)