High severity7.5NVD Advisory· Published Jun 29, 2021· Updated Jun 17, 2026
CVE-2021-32565
CVE-2021-32565
Description
Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.
Affected products
4cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*range: >=7.0.0,<=7.1.12
- (no CPE)range: 7.0.0-7.1.12, 8.0.0-8.1.1, 9.0.0-9.0.1
- (no CPE)range: Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1
Patches
Vulnerability mechanics
References
2- lists.apache.org/thread.html/ra1a41ff92a70d25bf576d7da2590575e8ff430393a3f4a0c34de4277%40%3Cusers.trafficserver.apache.org%3EnvdMailing ListVendor Advisory
- www.debian.org/security/2021/dsa-4957nvdThird Party Advisory
News mentions
0No linked articles in our index yet.