CVE-2020-9494

—

CVSS 3.1

7.5 high

EPSS

4%p90

Published

Jun 24, 2020 (Jun 24, 2020)

Modified

Jun 17, 2026

Description

Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can cause the server to allocate a large amount of memory and spin the thread.

Vendors: apache debian
Products: traffic server, debian linux
Weakness: CWE-770
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (3.9%)

In the news0 stories

No ingested article mentions this CVE yet.