Apache Traffic Server heap-buffer-overflow via HTTP Host header
Original title: Apache Traffic Server: heap-buffer-overflow via HTTP Host header (unbounded alloca pattern, 5 sites) — 90-day disclosure
90-day disclosure of heap-buffer-overflow in Apache Traffic Server master branch due to unbounded alloca in HttpTransact.cc.
Apache Traffic Server has a heap-buffer-overflow vulnerability via HTTP Host header using unbounded alloca pattern across 5 sites. The weakness is CWE-787 out-of-bounds write, verified by ASAN on HEAD <= 82605c6. Reporter is Innora Security Research. Pattern still present as of 2026-11-03.
- Unbounded alloca in HttpTransact.cc:1573
- CWE-787 confirmed by ASAN
- 5 sites affected by pattern
- 90-day disclosure timeline
- Target: Apache Traffic Server master
Impact: Heap-buffer-overflow via HTTP Host header
- Vendors
- Apache
- Products
- Traffic Server
From the original article
Posted by feng on Nov 03 Apache Traffic Server: heap-buffer-overflow via HTTP Host header (unbounded alloca pattern, 5 sites) — 90-day disclosure Reporter: Innora Security Research (feng () innora ai) Target: Apache Traffic Server master (verified on HEAD <= 82605c6 at report time; pattern still present on master as of 2026-11-03, HttpTransact.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.